The upshift-config npm package version 0.5.14 is a renamed repack of the legitimate @augustdigital/sdk, with identical files and README but includes a malicious postinstall lifecycle script. This script executes an inline Node.js command that sends a JSON payload containing os.hostname(), os.userInfo().username, process.cwd(), the package name/version, and a timestamp to a Cloudflare Workers subdomain designed to impersonate build/CDN infrastructure. The endpoint is unrelated to the legitimate package maintainers and is undisclosed in the package metadata. The only malicious behavior is this silent data exfiltration during npm install. No second-stage payloads or credential-stealing code were detected in the package contents.

Hosts that install [email protected] leak identifying system information (hostname, username, working directory) to an attacker-controlled endpoint. This reconnaissance data disclosure could aid attackers in further targeting or profiling compromised environments. No direct code execution or credential theft beyond this data exfiltration is reported.

Avoid installing [email protected]. Remove any installations of this package from your environment. Since no official fix or patch is available, rely on package source verification and use only trusted npm packages from verified maintainers. Monitor for any unauthorized use of this package in your dependency trees. Consider using npm security tools to detect malicious postinstall scripts. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.