Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in augustdigital-sdk (npm)

Malicious npm package augustdigital-sdk v8.20.1 was published as a typosquatting attack on the legitimate scoped package @augustdigital/sdk. The package contained a postinstall hook that exfiltrates system metadata (hostname, username, working directory) to a Cloudflare Workers endpoint disguised as infrastructure health monitoring.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Unknown; depends on installation count before removal. Potential exposure of hostname, username, working directory, and timestamp from affected systems.
Ecosystems
npm
Attack vectors
TyposquattingCompromised package
Affected entities
  • augustdigital-sdk · 8.20.1
  • upshift-financeRelated malicious package published by same account
  • upshift-configRelated malicious package published by same account

On 2026-08-10, a freemail npm account awugochogabriel (awugochogabriel@gmail.com) published three malicious packages—augustdigital-sdk, upshift-finance, and upshift-config—as first-ever releases within ~20 seconds of each other. The account has no relationship to August Digital's legitimate corporate maintainers.\n\nThe augustdigital-sdk@8.20.1 package is a byte-identical copy of the genuine @augustdigital/sdk@8.20.1 release (published ~2 hours earlier), designed to masquerade as a legitimate mirror or re-release. The package contains 316 files and even includes a README instructing users to npm install @augustdigital/sdk.\n\nA malicious postinstall hook was grafted into the package manifest. On installation, it executes an inline Node.js script that sends an HTTPS GET request to https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/ carrying the system hostname, username, current working directory, package name/version, and an ISO timestamp. The endpoint is a Cloudflare Workers subdomain deliberately named to impersonate build and CDN health infrastructure. The exfiltration is wrapped in try/catch to fail silently, and no disclosure or opt-out mechanism is provided in the README, package.json, or LICENSE.\n\nAnalysis of the bundled lib/ directory found only legitimate code from the genuine SDK.

Indicators of compromise

Packages
  • augustdigital-sdk
  • upshift-finance
  • upshift-config
Domains
  • build-metrics-collector.cdn-ops-health.workers.dev

Remediation

  • Immediately uninstall augustdigital-sdk, upshift-finance, and upshift-config from all systems.
  • Use the legitimate scoped package @augustdigital/sdk instead of the unscoped augustdigital-sdk.
  • Review npm audit logs and package-lock.json files to identify systems that may have installed the malicious packages.
  • Assume compromise of hostname, username, and working directory information for any system that executed npm install of these packages.
  • Monitor for suspicious activity from affected systems, particularly outbound HTTPS connections to the identified Cloudflare Workers domain.
  • Report the malicious npm account awugochogabriel to npm security for account suspension and package removal.
  • Implement package name allowlisting or dependency scanning to prevent installation of unscoped packages when scoped alternatives exist.

Sources

  1. GitHub Advisory GHSA-pfx4-g5xh-hpf6 · GitHub Advisory Database

Cite this entry

"Malicious code in augustdigital-sdk (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 10, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-augustdigital-sdk-npm-1tm911

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in akamai-sensor (npm)

    A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.

    npmCompromised packageTyposquatting
  2. resolvedcritical

    Malicious code in depcruise-wrap-stream-in-html (npm)

    depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.

    npmCompromised packageDependency confusionTyposquatting
  3. resolvedcritical

    Malicious code in @finaxis/common-js (npm)

    The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.

    npmCompromised packageTyposquatting
  4. containedcritical

    Malicious code in alelo-api (npm)

    Malicious npm package alelo-api v99.0.0 contained code that exfiltrated environment variables, npm tokens, and local secrets to an attacker-controlled IP address during installation. The package appears to be a typosquat/dependency-confusion attack targeting the Alelo organization.

    npmCompromised packageTyposquatting