augustdigital-sdk @8.20.1

Summary

package.json declares a postinstall script that runs an inline node -e invoking https.get against https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/ with a URL-encoded JSON payload containing os.hostname() , os.userInfo().username , process.cwd() , and the package name/version/timestamp. The destination is a generic Cloudflare Workers subdomain unrelated to the package's declared publisher (augustdigital.io / fractalprotocol.org). Errors are swallowed so the beacon is silent. Host and user identifiers are transmitted to a non-publisher endpoint automatically on npm install , without disclosure or opt-out.

Source: amazon-inspector (1c0362677faae34af2e3540e4f2e59430f82bbc585ae0f75a403b71ddb7d2fbc)