{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "f40ce98f65fd888ee41c09a8a85001c235a2ad90d53b385511bbb4603eb61122",
              "tlsh": "50e07d0448f9443631629455f91e481e75479801113af14769cf9a101780588c01d2da"
            },
            {
              "path": "package.json",
              "sha256": "f60c5f51e56555a5eea2b34bd3a40d6f9e87819fd7d6d17145a5423da3642cc7",
              "tlsh": "88d02b704e61953331c106e6886ad457a2718f6f04087c0867cb143c81dd37398ff30c"
            }
          ],
          "package_integrity": [
            {
              "filename": "domain-widget-100.0.0.tgz",
              "hashes": {
                "sha1": "448c7d3be662d6eac5b15d49ece897fcf48b3042",
                "sha512_sri": "sha512-TIt1ld9oNzKCFpfhO8djawyTWDdlloK3S/Iug6HGje1CkVKS2yzOKUlWqQQeSPm2M0oFnY+8LhduqJJJph4X4g=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@uh-platform/domain-widget"
      },
      "versions": [
        "100.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020270",
        "import_time": "2026-09-21T19:14:59.912928655Z",
        "modified_time": "2026-09-21T18:56:28Z",
        "sha256": "1fa27cef146dec157eaf78519d56ff2ef696f32e99746cdabea9e30be7c03b96",
        "source": "amazon-inspector",
        "versions": [
          "100.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1fa27cef146dec157eaf78519d56ff2ef696f32e99746cdabea9e30be7c03b96)\nPackage @uh-platform/domain-widget@100.0.0 is a scoped placeholder with an empty author, generic description, and no real functionality. Its package.json declares scripts.preinstall = \"node index.js\", and index.js shells out via exec() to curl a hardcoded Burp Collaborator subdomain at http://pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/. On `npm install`, the installer\u0027s host performs a DNS+HTTP request to that attacker-controlled OAST endpoint, disclosing the installer\u0027s IP and host presence and confirming out-of-band code execution on the build machine. The `@uh-platform` scope combined with an inflated 100.0.0 version, empty metadata, and a preinstall-only payload is the canonical dependency-confusion shape targeting an internal namespace to shadow a private package during resolution.\n",
  "id": "MAL-2026-16359",
  "modified": "2026-09-21T18:56:28Z",
  "published": "2026-09-21T18:56:28Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@uh-platform/domain-widget/v/100.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @uh-platform/domain-widget (npm)"
}