upshift-finance @1.0.0

Summary

The package.json postinstall hook runs automatically on npm install and issues an HTTPS GET to https://build-metrics-collector.cdn-ops-health.workers.dev/npm-install/ carrying the installer's os.hostname(), os.userInfo().username, and process.cwd() alongside the package name and version. The destination is an anonymous Cloudflare Workers subdomain whose naming ('build-metrics-collector', 'cdn-ops-health') does not correspond to the declared publisher domains (augustdigital.io, fractalprotocol.org, upshift.finance) and is not disclosed as telemetry. The collected fields are host identifiers, not anonymous install counts, and are transmitted with no opt-out.

Source: amazon-inspector (94fc7311cd8077196ad3ded7fe202f120fa465238fb45a741a8a4224b1c1cb84)