MalwarePublished 11 Aug 2026Updated 12 Aug 2026

upshift-finance (npm) · Malicious Code

Affects upshift-financeSource GCVE Database

Malicious package : remove upshift-finance and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:39 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13777

What to do

Remove upshift-finance from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmupshift-finance	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The upshift-finance npm package version 1.0.0 is a malicious repack of the legitimate @augustdigital/sdk package. It includes a postinstall script that silently sends host-specific information such as hostname, username, and working directory to an attacker-controlled Cloudflare Workers endpoint. The malicious behavior is limited to this data exfiltration beacon, with no additional payload or credential theft observed. This package was published by an unrelated freemail account shortly after two similarly named packages, indicating a brand hijack attempt. Hosts that installed this package have had identifying information disclosed to the attacker.

Impact

Hosts that install this malicious package leak their hostname, username, and current working directory path to an attacker-controlled endpoint. This disclosure of host-specific information can aid attackers in reconnaissance and further targeted attacks. No direct credential theft or secondary payload delivery has been observed. The malicious behavior occurs silently during npm install, potentially affecting any environment where this package is installed.

Defensive guidance

The recommended mitigation is to avoid installing the upshift-finance package version 1.0.0 and instead use the legitimate @augustdigital/sdk package from its official source. Hosts that have installed the malicious package should consider the disclosed host information compromised and take appropriate internal security measures. Monitor for and remove any instances of the upshift-finance package from your environments.

Summary

The upshift-finance npm package (version 1.0.0) is a renamed repack of the legitimate @augustdigital/sdk package, with an added unconditional postinstall hook. This hook executes a node script on installation that sends the installer's os.hostname(), os.userInfo().username, process.cwd(), package name, version, and timestamp via HTTPS GET to a Cloudflare Workers subdomain impersonating build/CDN health infrastructure. The endpoint is not disclosed in the package metadata, and there is no opt-out mechanism. The rest of the package code is identical to the legitimate SDK and contains no further malicious code. This behavior leaks host-identifying information to an attacker-controlled server.

References

npmjs.com/package/upshift-finance/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:39 UTC

Technical details

References

Community reviews