upshift-financenpm
upshift-finance is a confirmed malicious npm package (MAL-2026-13777) that steals credentials and exfiltrates sensitive data. Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in upshift-finance (npm)
What this malware does
upshift-finance is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk ("Upshift" is the DeFi product name used throughout the real SDK, e.g. app.upshift.finance). Its published 1.0.0 body is byte-identical to augustdigital-sdk and ships the real SDK's README describing itself as the "August Digital SDK". It is one of three packages — with augustdigital-sdk, upshift-finance and upshift-config — published as first-ever releases from the sole freemail npm account awugochogabriel ([email protected]) within ~20 seconds of each other on 2026-08-10, an account with no relationship to August Digital's real corporate maintainers.
The package body is a byte-identical repack of the genuine SDK (316 files; the shipped README even instructs users to npm install @augustdigital/sdk) with a single unconditional postinstall hook grafted onto the manifest. On npm install the hook runs an inline node -e script that issues an HTTPS GET to https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/ carrying os.hostname(), os.userInfo().username, process.cwd(), the package name/version and an ISO timestamp, wrapped in try/catch so failures are silent. The endpoint is a Cloudflare Workers subdomain deliberately named to impersonate build/CDN health infrastructure and is disclosed nowhere in the README, package.json or LICENSE, with no opt-out. Analysis of the bundled lib/ found only legitimate chain RPC/explorer endpoints and no second stage or credential-reading code; the injected postinstall beacon is the sole malicious behavior. Hosts that installed it have leaked their hostname, username and working-directory path to the attacker and should treat that data as disclosed.
Malicious versions
Every published version of this package is considered malicious — remove it entirely.
Detection & response playbook
Credential / info stealerFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for upshift-finance (all published versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging upshift-finance across your stack and pipelines.
If you installed it — respond
upshift-finance is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If upshift-finance was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks upshift-finance before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Credits
- SafeDep · finder
Detect & block this
O3 blocks upshift-finance-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.