upshift-config

Details

**Severity:** Critical

**Affected versions:** `> 0`

upshift-config is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package `@augustdigital/sdk`. The version 0.5.14 is fabricated to imply a release history the package does not have (it is a first-ever publish). Its body is byte-identical to `augustdigital-sdk` and ships the real SDK's README describing itself as the "August Digital SDK". It is one of three packages — with `augustdigital-sdk`, `upshift-finance` and `upshift-config` — published as first-ever releases from the sole freemail npm account `awugochogabriel` ([email protected]) within ~20 seconds of each other on 2026-08-10, an account with no relationship to August Digital's real corporate maintainers.

The package body is a byte-identical repack of the genuine SDK (316 files; the shipped README even instructs users to `npm install @augustdigital/sdk`) with a single unconditional `postinstall` hook grafted onto the manifest. On `npm install` the hook runs an inline `node -e` script that issues an HTTPS GET to `https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/` carrying `os.hostname()`, `os.userInfo().username`, `process.cwd()`, the package name/version and an ISO timestamp, wrapped in try/catch so failures are silent. The endpoint is a Cloudflare Workers subdomain deliberately named to impersonate build/CDN health infrastructure and is disclosed nowhere in the README, package.json or LICENSE, with no opt-out. Analysis of the bundled `lib/` found only legitimate chain RPC/explorer endpoints and no second stage or credential-reading code; the injected postinstall beacon is the sole malicious behavior. Hosts that installed it have leaked their hostname, username and working-directory path to the attacker and should treat that data as disclosed.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff6eb4ff2a46a08aa5fa40d31d238360110caaca/osv/malicious/npm/upshift-config/MAL-2026-13776.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff6eb4ff2a46a08aa5fa40d31d238360110caaca/osv/malicious/npm/upshift-config/MAL-2026-13776.json
- https://github.com/ossf/malicious-packages/blob/b33600c98c614ac591d9e3949e4ec5bfbae4052f/osv/malicious/npm/upshift-config/MAL-2026-13776.json
- https://www.npmjs.com/package/upshift-config/v/0.5.14
- https://github.com/advisories/GHSA-75gq-p797-7w4c

Compromised versions (1)

• > 0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.