npm: 10 Malicious Packages in '@uh-platform' Scope Drop in Under a Minute
Ten malicious npm packages, primarily under the `@uh-platform/` scope, were disclosed within a single minute on September 21, 2026, indicating a highly coordinated supply chain attack.
Key findings
- Ten malicious npm packages disclosed within a single minute on September 21, 2026.
- Many packages share the
@uh-platform/npm scope, indicating a coordinated campaign. - Packages were recently published, some just hours before disclosure, suggesting purpose-built malware.
- Malware communicates with external domains, including
hqbv58hgt1sjk7vf7ru4o0mwzn5etahz.oastify.com. - Behavioral analysis shows command execution and communication with malicious infrastructure.
- All advisories are rated Critical severity, indicating full system compromise risk.
On September 21, 2026, ten malicious packages were disclosed on npm within a single minute, all exhibiting characteristics of a coordinated campaign targeting the JavaScript ecosystem. These packages were all very recently published, with most appearing on the registry just hours before their disclosure, suggesting they were purpose-built for this attack.
The campaign prominently features packages published under the @uh-platform/ npm scope, including @uh-platform/domain-widget, @uh-platform/webcard, @uh-platform/nadaver2, @uh-platform/nadaver, and @uh-platform/cloud. Another package, @asdfaskdjfksadhfkasf/nadaver2, appears to be a variant or related component, sharing a similar naming convention despite a different scope. The rapid publication and shared naming patterns strongly suggest a single threat actor or group.
Analysis of the malicious packages, such as @asdfaskdjfksadhfkasf/nadaver2, reveals highly dangerous behavior. These packages are designed to communicate with external domains associated with malicious activity and execute arbitrary commands on the compromised system. Specifically, observed behavior includes communication with hqbv58hgt1sjk7vf7ru4o0mwzn5etahz.oastify.com, a domain often used for OAST (Out-of-Band Application Security Testing) or as a C2 (Command and Control) server for data exfiltration or further instruction.
The critical severity assigned to these advisories underscores the severe risk posed to any system that installed these packages. A successful compromise means that the attacker could gain full control over the affected machine, potentially leading to data theft, credential exfiltration, or further network infiltration. Users are advised to consider any system that installed these packages as fully compromised and take immediate remediation steps.
Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the disclosed malicious packages. If found, all credentials used on the affected systems should be rotated, and a thorough forensic investigation should be conducted. Specific package names to look for include:
@uh-platform/domain-widget@uh-platform/webcard@uh-platform/nadaver2@uh-platform/nadaver@uh-platform/cloud@asdfaskdjfksadhfkasf/nadaver2bytepack-probe-a7x3blue-string-formatter-utilssmy-ctf-helper-script-9921@uol-afiliados/affiliated-config-lib
Furthermore, organizations should review npm token logs for any unauthorized publishes that might indicate a compromised developer account.
This burst highlights the ongoing threat of supply chain attacks, where attackers leverage package registries to distribute malicious code. The extremely tight disclosure window suggests a highly automated or well-orchestrated attack, emphasizing the need for robust automated scanning and rapid response mechanisms within the open-source ecosystem.