upshift-config @0.5.14

Summary

package.json declares a postinstall lifecycle script that runs an inline Node one-liner performing an HTTPS GET to https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/ with a URL-encoded JSON payload containing os.hostname(), os.userInfo().username, process.cwd(), a timestamp, and the package name/version. Errors are swallowed in a try/catch. The destination host does not match the package's stated publisher domains (augustdigital.io, upshift.finance, fractalprotocol.org) and is a generically-named Cloudflare Workers subdomain. On every npm install, installer-identifying reconnaissance data is transmitted to a third-party endpoint with no disclosure or opt-out.

Source: amazon-inspector (995333c28d95e45da0e7479b0c572ee1469c50a65e5d56593df831c76bcd3908)