Malicious code in upshift-config (npm)

On 2026-08-10, three npm packages were published within ~20 seconds from a single freemail account (awugochogabriel@gmail.com) with no relationship to August Digital's legitimate maintainers. The packages—upshift-config, upshift-finance, and augustdigital-sdk—were all published as first-ever releases, with upshift-config falsely versioned as 0.5.14 to imply a release history.\n\nEach package is a byte-identical repack of the genuine August Digital SDK (316 files), including the original README that instructs users to install the legitimate scoped package @augustdigital/sdk. A single unconditional postinstall hook was grafted into the package manifest.\n\nUpon installation, the postinstall hook executes an inline Node.js script that sends an HTTPS GET request to https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/ carrying system metadata: os.hostname(), os.userInfo().username, process.cwd(), package name/version, and an ISO timestamp. The endpoint is a Cloudflare Workers subdomain deliberately named to impersonate build/CDN health infrastructure. The exfiltration is wrapped in try/catch to fail silently.\n\nNo disclosure of this behavior appears in the README, package.json, or LICENSE. This represents a coordinated typosquatting and supply chain attack targeting users seeking the legitimate August Digital SDK.