upshift-config

{"schema_version":"1.7.4","id":"MAL-2026-13776","published":"2026-08-11T00:00:00Z","modified":"2026-08-12T12:53:41.532931872Z","summary":"Malicious code in upshift-config (npm)","details":"upshift-config is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package `@augustdigital/sdk`. The version 0.5.14 is fabricated to imply a release history the package does not have (it is a first-ever publish). Its body is byte-identical to `augustdigital-sdk` and ships the real SDK's README describing itself as the \"August Digital SDK\". It is one of three packages — with `augustdigital-sdk`, `upshift-finance` and `upshift-config` — published as first-ever releases from the sole freemail npm account `awugochogabriel` (awugochogabriel@gmail.com) within ~20 seconds of each other on 2026-08-10, an account with no relationship to August Digital's real corporate maintainers.\n\nThe package body is a byte-identical repack of the genuine SDK (316 files; the shipped README even instructs users to `npm install @augustdigital/sdk`) with a single unconditional `postinstall` hook grafted onto the manifest. On `npm install` the hook runs an inline `node -e` script that issues an HTTPS GET to `https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/` carrying `os.hostname()`, `os.userInfo().username`, `process.cwd()`, the package name/version and an ISO timestamp, wrapped in try/catch so failures are silent. The endpoint is a Cloudflare Workers subdomain deliberately named to impersonate build/CDN health infrastructure and is disclosed nowhere in the README, package.json or LICENSE, with no opt-out. Analysis of the bundled `lib/` found only legitimate chain RPC/explorer endpoints and no second stage or credential-reading code; the injected postinstall beacon is the sole malicious behavior. Hosts that installed it have leaked their hostname, username and working-directory path to the attacker and should treat that data as disclosed.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (995333c28d95e45da0e7479b0c572ee1469c50a65e5d56593df831c76bcd3908)\npackage.json declares a postinstall lifecycle script that runs an inline Node one-liner performing an HTTPS GET to https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/ with a URL-encoded JSON payload containing os.hostname(), os.userInfo().username, process.cwd(), a timestamp, and the package name/version. Errors are swallowed in a try/catch. The destination host does not match the package's stated publisher domains (augustdigital.io, upshift.finance, fractalprotocol.org) and is a generically-named Cloudflare Workers subdomain. On every npm install, installer-identifying reconnaissance data is transmitted to a third-party endpoint with no disclosure or opt-out.\n","affected":[{"package":{"name":"upshift-config","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.5.14"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"c0b3a86642b99260e48b484fd3e70c2e85ca8618eb83871c77c6f828a5da18e1","tlsh":"a3513f14cd1cceb312c92a48b87c5263a971aa278928bc1d73d6235d4f0d21f45fab3e"}],"package_integrity":[{"filename":"upshift-config-0.5.14.tgz","hashes":{"sha1":"f995523dfe530066fc3735016e1e24f2c2f9f91b","sha512_sri":"sha512-SyEJ6pqMPxP1xEWuJt4UbXlwW9rldM1pfK9/rJV6D9mY2jlajwCz60zCysyee7q5BGYAuDv1UNaN4+MOXurcFg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/upshift-config/v/0.5.14"}],"database_specific":{"iocs":{"domains":["build-metrics-collector.cdn-ops-health.workers.dev"],"urls":["https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-017465","import_time":"2026-08-12T12:51:43.723634299Z","modified_time":"2026-08-12T12:25:25Z","sha256":"995333c28d95e45da0e7479b0c572ee1469c50a65e5d56593df831c76bcd3908","source":"amazon-inspector","versions":["0.5.14"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}