MAL-2026-13777

upshift-finance is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package `@augustdigital/sdk` ("Upshift" is the DeFi product name used throughout the real SDK, e.g. app.upshift.finance). Its published 1.0.0 body is byte-identical to `augustdigital-sdk` and ships the real SDK's README describing itself as the "August Digital SDK". It is one of three packages — with `augustdigital-sdk`, `upshift-finance` and `upshift-config` — published as first-ever releases from the sole freemail npm account `awugochogabriel` (awugochogabriel@gmail.com) within ~20 seconds of each other on 2026-08-10, an account with no relationship to August Digital's real corporate maintainers.

The package body is a byte-identical repack of the genuine SDK (316 files; the shipped README even instructs users to `npm install @augustdigital/sdk`) with a single unconditional `postinstall` hook grafted onto the manifest. On `npm install` the hook runs an inline `node -e` script that issues an HTTPS GET to `https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/` carrying `os.hostname()`, `os.userInfo().username`, `process.cwd()`, the package name/version and an ISO timestamp, wrapped in try/catch so failures are silent. The endpoint is a Cloudflare Workers subdomain deliberately named to impersonate build/CDN health infrastructure and is disclosed nowhere in the README, package.json or LICENSE, with no opt-out. Analysis of the bundled `lib/` found only legitimate chain RPC/explorer endpoints and no second stage or credential-reading code; the injected postinstall beacon is the sole malicious behavior. Hosts that installed it have leaked their hostname, username and working-directory path to the attacker and should treat that data as disclosed.

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (94fc7311cd8077196ad3ded7fe202f120fa465238fb45a741a8a4224b1c1cb84) The package.json postinstall hook runs automatically on npm install and issues an HTTPS GET to https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/ carrying the installer's os.hostname(), os.userInfo().username, and process.cwd() alongside the package name and version. The destination is an anonymous Cloudflare Workers subdomain whose naming ('build-metrics-collector', 'cdn-ops-health') does not correspond to the declared publisher domains (augustdigital.io, fractalprotocol.org, upshift.finance) and is not disclosed as telemetry. The collected fields are host identifiers, not anonymous install counts, and are transmitted with no opt-out.