MalwarePublished 11 Aug 2026Updated 12 Aug 2026

upshift-config (npm) · Malicious Code

Affects upshift-configSource GCVE Database

Malicious package : remove upshift-config and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:39 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13776

What to do

Remove upshift-config from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmupshift-config	Affected =0.5.14	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package upshift-config version 0.5.14 is a malicious repack of the legitimate @augustdigital/sdk package. It includes a postinstall script that silently sends system information such as hostname, username, and working directory to an attacker-controlled Cloudflare Workers endpoint. This data exfiltration occurs without disclosure or opt-out. The package was published by an unrelated freemail account impersonating the legitimate maintainers. No additional malicious payloads or credential theft mechanisms were found beyond this reconnaissance beacon.

Impact

Hosts that install upshift-config@0.5.14 leak identifying system information (hostname, username, working directory) to an attacker-controlled endpoint. This reconnaissance data disclosure could aid attackers in further targeting or profiling compromised environments. No direct code execution or credential theft beyond this data exfiltration is reported.

Defensive guidance

Avoid installing upshift-config@0.5.14. Remove any installations of this package from your environment. Monitor for any unauthorized use of this package in your dependency trees. Consider using npm security tools to detect malicious postinstall scripts.

Summary

The upshift-config npm package version 0.5.14 is a renamed repack of the legitimate @augustdigital/sdk, with identical files and README but includes a malicious postinstall lifecycle script. This script executes an inline Node.js command that sends a JSON payload containing os.hostname(), os.userInfo().username, process.cwd(), the package name/version, and a timestamp to a Cloudflare Workers subdomain designed to impersonate build/CDN infrastructure. The endpoint is unrelated to the legitimate package maintainers and is undisclosed in the package metadata. The only malicious behavior is this silent data exfiltration during npm install. No second-stage payloads or credential-stealing code were detected in the package contents.

References

npmjs.com/package/upshift-config/v/0.5.14 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:39 UTC

Technical details

References

Community reviews