registry / upshift-sdk / 8.20.1

upshift-sdk@8.20.1

JS SDK powering the August Digital ecosystem.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Installing the package automatically transmits local host and user metadata to an unrelated metrics endpoint. The transfer is silent and independent of SDK use.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall during package installation

Impact

Leaks installer identity and working-directory metadata to a third party.

Mechanism

silent install-time host metadata exfiltration via HTTPS GET

Attack narrative

During npm installation, package.json executes inline Node code that builds a JSON payload from npm package variables, hostname, username, cwd, and a timestamp, URL-encodes it, and sends it through https.get to build-metrics-collector.cdn-ops-health.workers.dev. Errors are silently ignored, so the collection is invisible to installers and does not require invoking the SDK.

Rationale

The postinstall hook performs concrete, unconsented collection and external transmission of local machine/user metadata. The benign-looking runtime analytics code does not mitigate this independent install-time behavior.

Evidence

package.jsonlib/core/analytics/sentry-runtime.jslib/main.jslib/core/analytics/user-identity.js

Network endpoints1

build-metrics-collector.cdn-ops-health.workers.dev/npm-install/

upshift-sdk@8.20.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code