MAL-2026-13776 Malicious code in upshift-config (npm)

upshift-config is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk. The version 0.5.14 is fabricated to imply a release history the package does not have (it is a first-ever publish). Its body is byte-identical to augustdigital-sdk and ships the real SDK's README describing itself as the "August Digital SDK". It is one of three packages — with augustdigital-sdk, upshift-finance and upshift-config — published as first-ever releases from the sole freemail npm account awugochogabriel ([email protected]) within ~20 seconds of each other on 2026-08-10, an account with no relationship to August Digital's real corporate maintainers.

The package body is a byte-identical repack of the genuine SDK (316 files; the shipped README even instructs users to npm install @augustdigital/sdk) with a single unconditional postinstall hook grafted onto the manifest. On npm install the hook runs an inline node -e script that issues an HTTPS GET to https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/ carrying os.hostname(), os.userInfo().username, process.cwd(), the package name/version and an ISO timestamp, wrapped in try/catch so failures are silent. The endpoint is a Cloudflare Workers subdomain deliberately named to impersonate build/CDN health infrastructure and is disclosed nowhere in the README, package.json or LICENSE, with no opt-out. Analysis of the bundled lib/ found only legitimate chain RPC/explorer endpoints and no second stage or credential-reading code; the injected postinstall beacon is the sole malicious behavior. Hosts that installed it have leaked their hostname, username and working-directory path to the attacker and should treat that data as disclosed.

package.json declares a postinstall lifecycle script that runs an inline Node one-liner performing an HTTPS GET to https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/ with a URL-encoded JSON payload containing os.hostname(), os.userInfo().username, process.cwd(), a timestamp, and the package name/version. Errors are swallowed in a try/catch. The destination host does not match the package's stated publisher domains (augustdigital.io, upshift.finance, fractalprotocol.org) and is a generically-named Cloudflare Workers subdomain. On every npm install, installer-identifying reconnaissance data is transmitted to a third-party endpoint with no disclosure or opt-out.