{"answers":{"affected":"1 open source package ship an affected version, including augustdigital-sdk.","exploited":"There is no known exploitation of MAL-2026-13774 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13774 is a malicious package in augustdigital-sdk, published on 11 Aug 2026."},"fix_prompt":"MAL-2026-13774 is a malicious package: augustdigital-sdk (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13774/ (Markdown: https://insights.sbomify.com/MAL-2026-13774/index.md)","id":"MAL-2026-13774","markdown":"https://insights.sbomify.com/MAL-2026-13774/index.md","name":"MAL-2026-13774","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"augustdigital-sdk is a malicious npm package — an unscoped brand-hijack of the legitimate, actively-maintained scoped package `@augustdigital/sdk`. Version 8.20.1 was copied verbatim from the genuine `@augustdigital/sdk@8.20.1` release (published ~2 hours earlier) to masquerade as a legitimate mirror or re-release. It is one of three packages — with `augustdigital-sdk`, `upshift-finance` and `upshift-config` — published as first-ever releases from the sole freemail npm account `awugochogabriel` (awugochogabriel@gmail.com) within ~20 seconds of each other on 2026-08-10, an account with no relationship to August Digital's real corporate maintainers.\n\nThe package body is a byte-identical repack of the genuine SDK (316 files; the shipped README even instructs users to `npm install @augustdigital/sdk`) with a single unconditional `postinstall` hook grafted onto the manifest. On `npm install` the hook runs an inline `node -e` script that issues an HTTPS GET to `https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/` carrying `os.hostname()`, `os.userInfo().username`, `process.cwd()`, the package name/version and an ISO timestamp, wrapped in try/catch so failures are silent. The endpoint is a Cloudflare Workers subdomain deliberately named to impersonate build/CDN health infrastructure and is disclosed nowhere in the README, package.json or LICENSE, with no opt-out. Analysis of the bundled `lib/` found only legitimate chain RPC/explorer endpoints and no second stage or credential-reading code; the injected postinstall beacon is the sole malicious behavior. Hosts that installed it have leaked their hostname, username and working-directory path to the attacker and should treat that data as disclosed.\n\npackage.json declares a postinstall script that runs an inline `node -e` invoking `https.get` against `https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/` with a URL-encoded JSON payload containing `os.hostname()`, `os.userInfo().username`, `process.cwd()`, and the package name/version/timestamp. The destination is a generic Cloudflare Workers subdomain unrelated to the package's declared publisher (augustdigital.io / fractalprotocol.org). Errors are swallowed so the beacon is silent. Host and user identifiers are transmitted to a non-publisher endpoint automatically on `npm install`, without disclosure or opt-out.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in augustdigital-sdk (npm)","id":"MAL-2026-13774","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"augustdigital-sdk","purl":"pkg:npm/augustdigital-sdk","source":"MAL-2026-13774"}],"products":null,"published":"2026-08-11","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13774/"}