The npm package @uh-platform/domain-widget@100.0.0 is a malicious package designed to perform out-of-band code execution during installation. It contains a preinstall script that executes code to send a DNS and HTTP request to an attacker-controlled domain, disclosing the installer's IP address and host information. This package mimics a private internal package namespace with an inflated version number and minimal metadata to facilitate dependency confusion attacks.