@uh-platform/domain-widget@100.0.0

Analysis

The package's preinstall hook runs node index.js, which executes a curl request to the attacker-controlled callback host hxxp://pa33pg1od9cr4ffnrzec8864jvpmdd12[.]oastify[.]com/ on every install. The package is a minimal stub (478 bytes) published at version 100.0.0 on the scoped name @uh-platform/domain-widget, with no functional code beyond the install-time beacon.