augustdigital-sdk

{"schema_version":"1.7.4","id":"MAL-2026-13774","published":"2026-08-11T00:00:00Z","modified":"2026-08-12T12:53:35.833543880Z","summary":"Malicious code in augustdigital-sdk (npm)","details":"augustdigital-sdk is a malicious npm package — an unscoped brand-hijack of the legitimate, actively-maintained scoped package `@augustdigital/sdk`. Version 8.20.1 was copied verbatim from the genuine `@augustdigital/sdk@8.20.1` release (published ~2 hours earlier) to masquerade as a legitimate mirror or re-release. It is one of three packages — with `augustdigital-sdk`, `upshift-finance` and `upshift-config` — published as first-ever releases from the sole freemail npm account `awugochogabriel` (awugochogabriel@gmail.com) within ~20 seconds of each other on 2026-08-10, an account with no relationship to August Digital's real corporate maintainers.\n\nThe package body is a byte-identical repack of the genuine SDK (316 files; the shipped README even instructs users to `npm install @augustdigital/sdk`) with a single unconditional `postinstall` hook grafted onto the manifest. On `npm install` the hook runs an inline `node -e` script that issues an HTTPS GET to `https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/` carrying `os.hostname()`, `os.userInfo().username`, `process.cwd()`, the package name/version and an ISO timestamp, wrapped in try/catch so failures are silent. The endpoint is a Cloudflare Workers subdomain deliberately named to impersonate build/CDN health infrastructure and is disclosed nowhere in the README, package.json or LICENSE, with no opt-out. Analysis of the bundled `lib/` found only legitimate chain RPC/explorer endpoints and no second stage or credential-reading code; the injected postinstall beacon is the sole malicious behavior. Hosts that installed it have leaked their hostname, username and working-directory path to the attacker and should treat that data as disclosed.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1c0362677faae34af2e3540e4f2e59430f82bbc585ae0f75a403b71ddb7d2fbc)\npackage.json declares a postinstall script that runs an inline `node -e` invoking `https.get` against `https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/` with a URL-encoded JSON payload containing `os.hostname()`, `os.userInfo().username`, `process.cwd()`, and the package name/version/timestamp. The destination is a generic Cloudflare Workers subdomain unrelated to the package's declared publisher (augustdigital.io / fractalprotocol.org). Errors are swallowed so the beacon is silent. Host and user identifiers are transmitted to a non-publisher endpoint automatically on `npm install`, without disclosure or opt-out.\n","affected":[{"package":{"name":"augustdigital-sdk","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["8.20.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"43e898192cd3872d18f166e135a7bb27a680b4923ebec77370b3c686cede0a96","tlsh":"93512e14cd18ceb312c92a4cb87c5263a9719a278528bc1d73c6235d8f0d21f45f9b3e"}],"package_integrity":[{"filename":"augustdigital-sdk-8.20.1.tgz","hashes":{"sha1":"12f84e3cb9c6c194ecdd47ad2db0ddaf769dfe05","sha512_sri":"sha512-sKGXB0vfp1YQAQrJTs8774eRaSc39MflTOUP2waRTjjqUgJlygRB3yFz3Q/BZld6/bwQNeIi4ZmtQZxLKH2wIw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/augustdigital-sdk/v/8.20.1"}],"database_specific":{"iocs":{"domains":["build-metrics-collector.cdn-ops-health.workers.dev"],"urls":["https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-017461","import_time":"2026-08-12T12:51:43.431347228Z","modified_time":"2026-08-12T12:24:56Z","sha256":"1c0362677faae34af2e3540e4f2e59430f82bbc585ae0f75a403b71ddb7d2fbc","source":"amazon-inspector","versions":["8.20.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}