If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (1bff275a2558640accb1a6956b933b71930ece1240bd8c5a0c2e00f74fc2fa82)
The package declares a postinstall script `node dist/recon.js` that runs automatically on `npm install`. The script collects installer-side reconnaissance data — hostname, username, SUDO_USER, home directory, current working directory, all local IPv4 addresses (including internal interfaces), DNS domain (via `dnsdomainname`), CI-provider flags, the full sorted list of `process.env` variable names, and a filtered subset of environment variable names matching secret/credential regex patterns — and POSTs the JSON payload over plain HTTP to the hardcoded bare IPv4 endpoint `http://138.68.108.20:80/cb`. An in-file comment frames the beacon as 'NON-SENSITIVE telemetry', but the destination is a bare IP with no publisher affiliation and the payload includes internal network topology and credential-shaped env variable names. The package presents itself as a scoped Shift Forex build compatible with the public `shift-sdk-v4` package and ships a minimal API-compatible stub in `dist/index.js`, consistent with a dependency-confusion lure against consumers who reference `shift-sdk-v4` from an internal registry.