Malicious Code Vulnerability in @uh-platform/cloud Package
Summary
MAL-2026-16358: Malicious code in @uh-platform/cloud (npm). Affects @uh-platform/cloud versions 101.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @uh-platform/cloud package is an npm library designed for cloud-related functionalities within applications. It is intended to provide developers with tools and utilities for cloud integration. However, this package has been identified to contain malicious code that compromises its integrity and poses significant security risks to users.
Vulnerability Detail
The vulnerability originates from the package's preinstall lifecycle script, which executes a command that sends the installer's hostname to a Burp Collaborator out-of-band collector. This occurs automatically during 'npm install' before any user code runs, allowing potential attackers to identify internal hosts and target them for further exploitation. The malicious behavior is indicative of a dependency-confusion reconnaissance pattern, where the package serves no legitimate purpose other than to exfiltrate sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @uh-platform/cloudIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the @uh-platform/cloud package until a secure version is released. Additionally, consider using alternative packages that provide similar functionalities without the associated risks.
Conclusion
The @uh-platform/cloud package contains a serious vulnerability due to embedded malicious code that can compromise user systems. It is essential to remove the affected package and monitor for updates. Utilizing tools like Vulert can help ensure your applications remain secure against such vulnerabilities.
See every vulnerability recorded for @uh-platform/cloud →
FAQ
The malicious code is designed to exfiltrate the installer's hostname to an external server, potentially allowing attackers to identify and target internal systems.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without any signup.
If you have installed the @uh-platform/cloud package, it is crucial to remove it immediately and check for any updates or patches that may address the vulnerability.
Yes, consider looking for alternative npm packages that provide similar cloud functionalities without the security risks associated with @uh-platform/cloud.
Vulert is a tool that monitors open-source vulnerabilities in your software using just the package-lock.json file. It provides real-time alerts for vulnerabilities, helping you maintain the security of your applications.
