MalwarePublished 21 Sep 2026

@uh-platform/nadaver (npm) · Malicious Code

Affects @uh-platform/nadaverSource GCVE Database

Malicious package : remove @uh-platform/nadaver and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:20 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-16360

What to do

Remove @uh-platform/nadaver from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@uh-platform/nadaver	Affected =102.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @uh-platform/nadaver version 102.0.0 contains malicious code that executes during installation. Its preinstall script runs a Node.js script that makes a DNS and HTTP request to an attacker-controlled domain, leaking the hostname of the machine performing the install. This behavior occurs without user interaction and is consistent with a dependency confusion attack targeting internal build systems.

Impact

The malicious preinstall script leaks the hostname of the machine installing the package to an attacker-controlled server. This can disclose internal network information and potentially aid attackers in further reconnaissance or targeted attacks. There is no indication of additional payloads or direct system compromise beyond information leakage.

Defensive guidance

Users should avoid installing the @uh-platform/nadaver package version 102.0.0 from the public npm registry. Verify package sources and scopes carefully to prevent dependency confusion attacks. Monitor for updates or advisories from the package maintainers or npm registry regarding this package.

Summary

The @uh-platform/nadaver npm package version 102.0.0 includes a preinstall script that executes `node index.js`. This script performs a curl request to a subdomain of an attacker-controlled domain (oastify.com), embedding the installer's hostname as a subdomain. This results in DNS resolution and HTTP requests that leak the installer's hostname to the attacker. The use of the @uh-platform scope and a high version number suggests the package is designed as a dependency confusion beacon to target internal build environments that resolve scoped packages from the public npm registry.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 24 Sep 2026, 04:23 UTC

Technical details

References

Community reviews