MAL-2026-16359

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@uh-platform/domain-widget/MAL-2026-16359.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16359
Published
2026-09-21T18:56:28Z
Modified
2026-09-21T19:30:05Z
Summary
Malicious code in @uh-platform/domain-widget (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1fa27cef146dec157eaf78519d56ff2ef696f32e99746cdabea9e30be7c03b96)

Package @uh-platform/domain-widget@100.0.0 is a scoped placeholder with an empty author, generic description, and no real functionality. Its package.json declares scripts.preinstall = "node index.js", and index.js shells out via exec() to curl a hardcoded Burp Collaborator subdomain at http://pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/. On npm install, the installer's host performs a DNS+HTTP request to that attacker-controlled OAST endpoint, disclosing the installer's IP and host presence and confirming out-of-band code execution on the build machine. The @uh-platform scope combined with an inflated 100.0.0 version, empty metadata, and a preinstall-only payload is the canonical dependency-confusion shape targeting an internal namespace to shadow a private package during resolution.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020270",
            "import_time":  "2026-09-21T19:14:59.912928655Z",
            "modified_time":  "2026-09-21T18:56:28Z",
            "sha256":  "1fa27cef146dec157eaf78519d56ff2ef696f32e99746cdabea9e30be7c03b96",
            "source":  "amazon-inspector",
            "versions":  [
                "100.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @uh-platform/domain-widget

Package

Name
@uh-platform/domain-widget
View open source insights on deps.dev
Purl
pkg:npm/%40uh-platform/domain-widget

Affected ranges

Affected versions

100.*
100.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "f40ce98f65fd888ee41c09a8a85001c235a2ad90d53b385511bbb4603eb61122",
            "tlsh":  "50e07d0448f9443631629455f91e481e75479801113af14769cf9a101780588c01d2da"
        },
        {
            "path":  "package.json",
            "sha256":  "f60c5f51e56555a5eea2b34bd3a40d6f9e87819fd7d6d17145a5423da3642cc7",
            "tlsh":  "88d02b704e61953331c106e6886ad457a2718f6f04087c0867cb143c81dd37398ff30c"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "domain-widget-100.0.0.tgz",
            "hashes":  {
                "sha1":  "448c7d3be662d6eac5b15d49ece897fcf48b3042",
                "sha512_sri":  "sha512-TIt1ld9oNzKCFpfhO8djawyTWDdlloK3S/Iug6HGje1CkVKS2yzOKUlWqQQeSPm2M0oFnY+8LhduqJJJph4X4g=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@uh-platform/domain-widget/MAL-2026-16359.json"