The npm package upshift-config version 0.5.14 is a malicious repack of the legitimate @augustdigital/sdk package. It includes a postinstall script that silently sends system information such as hostname, username, and working directory to an attacker-controlled Cloudflare Workers endpoint. This data exfiltration occurs without disclosure or opt-out. The package was published by an unrelated freemail account impersonating the legitimate maintainers. No additional malicious payloads or credential theft mechanisms were found beyond this reconnaissance beacon.