Which versions of upshift-finance are malicious?

The following npm versions of upshift-finance are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate upshift-finance if I installed it?

upshift-finance is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed upshift-finance — how do I know if it already compromised me?

If upshift-finance was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is upshift-finance part of a known attack campaign?

Yes — upshift-finance is associated with the IN-MAL-2026-017467 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find upshift-finance across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for upshift-finance (version 1.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging upshift-finance across your stack and pipelines.

Malicious package

upshift-financenpm

upshift-finance is a confirmed malicious npm package (MAL-2026-13777) that steals credentials and exfiltrates sensitive data (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in upshift-finance (npm)

MAL-2026-13777

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall upshift-finance

What this malware does

upshift-finance is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk ("Upshift" is the DeFi product name used throughout the real SDK, e.g. app.upshift.finance). Its published 1.0.0 body is byte-identical to augustdigital-sdk and ships the real SDK's README describing itself as the "August Digital SDK". It is one of three packages — with augustdigital-sdk, upshift-finance and upshift-config — published as first-ever releases from the sole freemail npm account awugochogabriel ([email protected]) within ~20 seconds of each other on 2026-08-10, an account with no relationship to August Digital's real corporate maintainers.

The package body is a byte-identical repack of the genuine SDK (316 files; the shipped README even instructs users to npm install @augustdigital/sdk) with a single unconditional postinstall hook grafted onto the manifest. On npm install the hook runs an inline node -e script that issues an HTTPS GET to https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/ carrying os.hostname(), os.userInfo().username, process.cwd(), the package name/version and an ISO timestamp, wrapped in try/catch so failures are silent. The endpoint is a Cloudflare Workers subdomain deliberately named to impersonate build/CDN health infrastructure and is disclosed nowhere in the README, package.json or LICENSE, with no opt-out. Analysis of the bundled lib/ found only legitimate chain RPC/explorer endpoints and no second stage or credential-reading code; the injected postinstall beacon is the sole malicious behavior. Hosts that installed it have leaked their hostname, username and working-directory path to the attacker and should treat that data as disclosed.

The package.json postinstall hook runs automatically on npm install and issues an HTTPS GET to https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/ carrying the installer's os.hostname(), os.userInfo().username, and process.cwd() alongside the package name and version. The destination is an anonymous Cloudflare Workers subdomain whose naming ('build-metrics-collector', 'cdn-ops-health') does not correspond to the declared publisher domains (augustdigital.io, fractalprotocol.org, upshift.finance) and is not disclosed as telemetry. The collected fields are host identifiers, not anonymous install counts, and are transmitted with no opt-out.

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

94fc7311cd8077196ad3ded7fe202f120fa465238fb45a741a8a4224b1c1cb84

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for upshift-finance (version 1.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging upshift-finance across your stack and pipelines.
If you installed it — respond
upshift-finance is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If upshift-finance was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks upshift-finance before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. upshift-finance on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-017467

References

npmjs.com

Credits

Amazon Inspector · finder
SafeDep · finder

Detect & block this

O3 blocks upshift-finance-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database