@uh-platform/webcard@99.0.0: Malicious npm security report

OSV Malicious Advisory

imported 19d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16362 confirms this npm version as malicious. @uh-platform/webcard@99.0.0 declares a preinstall hook that runs index.js, which shells out to curl against a unique Burp Collaborator subdomain at http://pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/. This fires unconditionally on npm install and confirms code execution and DNS/HTTP callback from the installer's host to an attacker-controlled out-of-band collector. The package version is 99.0.0 under an org scope...

Advisory

MAL-2026-16362

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @uh-platform/webcard (npm)

Details

@uh-platform/webcard@99.0.0 declares a preinstall hook that runs index.js, which shells out to curl against a unique Burp Collaborator subdomain at http://pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/. This fires unconditionally on npm install and confirms code execution and DNS/HTTP callback from the installer's host to an attacker-controlled out-of-band collector. The package version is 99.0.0 under an org scope with a self-referential dependency on @uh-platform/webcard@1.0.2 and a redacted SDK description, matching the canonical dependency-confusion shape aimed at hijacking resolution of an internal scoped package name.

Decision reason

OpenSSF Malicious Packages via OSV confirms @uh-platform/webcard@99.0.0 as malicious (MAL-2026-16362): Malicious code in @uh-platform/webcard (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

@uh-platform/webcard@99.0.0

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code