Malicious code in upshift-finance (npm)
Three malicious npm packages (upshift-finance, augustdigital-sdk, upshift-config) were published on 2026-08-10 by a freemail account impersonating August Digital's maintainers. The packages are byte-identical repacks of the legitimate @augustdigital/sdk with a malicious postinstall hook that exfiltrates system metadata to a Cloudflare Workers endpoint.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed upshift-finance version 1.0.0
- Ecosystems
- Attack vectors
- Affected entities
- upshift-finance · 1.0.0
- augustdigital-sdk · 1.0.0
- upshift-config · 1.0.0
On 2026-08-10, three npm packages were published within ~20 seconds of each other from a single freemail account (awugochogabriel@gmail.com) with no legitimate relationship to August Digital: upshift-finance, augustdigital-sdk, and upshift-config. All three were first-ever releases from this account.
The upshift-finance package is a byte-identical repack of the legitimate scoped package @augustdigital/sdk, even retaining the original README that instructs users to install the real SDK. The only modification is a malicious postinstall hook added to package.json.
When installed, the postinstall hook executes an inline Node.js script that sends an HTTPS GET request to https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/ carrying sensitive system information: hostname, username, current working directory, package name/version, and an ISO timestamp. The endpoint is deliberately named to impersonate legitimate build/CDN health infrastructure. The exfiltration is wrapped in try/catch to fail silently, and no disclosure or opt-out mechanism is provided.
This represents a combination of typosquatting (brand hijacking of the legitimate SDK) and a compromised package distribution with data exfiltration capabilities.
Indicators of compromise
- Packages
- upshift-finance
- augustdigital-sdk
- upshift-config
- Domains
- build-metrics-collector.cdn-ops-health.workers.dev
Remediation
- Immediately uninstall upshift-finance, augustdigital-sdk, and upshift-config from all environments
- Audit npm install logs for any installations of these packages between 2026-08-10 and detection
- Assume any system that installed these packages may have had hostname, username, and working directory exfiltrated; review access logs for those systems
- Use the legitimate @augustdigital/sdk scoped package instead
- Enable npm audit and consider using npm provenance verification to detect similar attacks
- Monitor for any suspicious activity from systems that installed the malicious packages
Sources
- GitHub Advisory GHSA-p98f-6986-rf79 · GitHub Advisory Database
Cite this entry
"Malicious code in upshift-finance (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 10, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-upshift-finance-npm-1nqb32
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in wct-st (npm)
The npm package wct-st contained malicious code in its postinstall lifecycle script that collected and exfiltrated host identifiers to a remote endpoint. The package name resembles the deprecated web-component-tester, consistent with a typosquatting attack.
npmCompromised packageTyposquatting