The npm package @uh-platform/webcard version 99.0.0 contains malicious code that executes during installation. It runs a preinstall hook that executes index.js, which performs an HTTP request to an attacker-controlled domain, confirming code execution and data exfiltration via DNS/HTTP callbacks. This package also exhibits characteristics of dependency confusion attacks by referencing an internal scoped package version 1.0.2.