If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (e86de9ce7bfa06a95a3e4d6c68f188d2c8c8b35537645e94a2fb3fee4c1e0e81)
shift-v4-sdk@1.0.5 is a typosquat of the scoped package @shiftforex/shift-sdk-v4 (self-identified as such in a comment inside dist/index.js). Its postinstall script dist/recon.js runs automatically on npm install and collects the installer's hostname, user, sudo_user, home directory, cwd, DNS domain (via dnsdomainname), network interfaces and IP addresses, the full list of process.env variable names, and a filtered subset of env-var names matching credential-shaped patterns (AWS, GCP, AZURE, NPM, TOKEN, SECRET, KEY, PASS, CRED, GITHUB, GITLAB, SSH). The JSON blob is POSTed over plaintext HTTP to http://138.68.108.20/cb. An in-file comment framing this as 'non-sensitive telemetry' contradicts the actual behavior (host fingerprint plus secret-shaped env-var name enumeration is reconnaissance for follow-on targeting).