The npm package @uh-platform/nadaver version 102.0.0 contains malicious code that executes during installation. Its preinstall script runs a Node.js script that makes a DNS and HTTP request to an attacker-controlled domain, leaking the hostname of the machine performing the install. This behavior occurs without user interaction and is consistent with a dependency confusion attack targeting internal build systems.