The upshift-finance npm package (version 1.0.0) is a renamed repack of the legitimate @augustdigital/sdk package, with an added unconditional postinstall hook. This hook executes a node script on installation that sends the installer's os.hostname(), os.userInfo().username, process.cwd(), package name, version, and timestamp via HTTPS GET to a Cloudflare Workers subdomain impersonating build/CDN health infrastructure. The endpoint is not disclosed in the package metadata, and there is no opt-out mechanism. The rest of the package code is identical to the legitimate SDK and contains no further malicious code. This behavior leaks host-identifying information to an attacker-controlled server.

Hosts that install this malicious package leak their hostname, username, and current working directory path to an attacker-controlled endpoint. This disclosure of host-specific information can aid attackers in reconnaissance and further targeted attacks. No direct credential theft or secondary payload delivery has been observed. The malicious behavior occurs silently during npm install, potentially affecting any environment where this package is installed.

No official patch or fix is available for this malicious package. The recommended mitigation is to avoid installing the upshift-finance package version 1.0.0 and instead use the legitimate @augustdigital/sdk package from its official source. Hosts that have installed the malicious package should consider the disclosed host information compromised and take appropriate internal security measures. Monitor for and remove any instances of the upshift-finance package from your environments.