MAL-2026-13435

Dashboard / Malicious Package / MAL-2026-13435

MAL-2026-13435

Summary: Malicious code in @united-airlines-org/atmos-design-system (npm)

Details: The package @united-airlines-org/atmos-design-system contains a malicious `preinstall` script in its package.json that runs automatically during installation. The script executes `curl` to send the machine's hostname, obtained via `uname -n` and base64-encoded, to the attacker-controlled endpoint `https://bxss.boll-sec.de/hostname_<base64-hostname>`. This exfiltrates host reconnaissance data to a remote server. All versions of the package are malicious. Source: amazon-inspector (5683e7389b9b288024f2c9827c3649d7b291996625265f6365535121fc1f431a) Package @united-airlines-org/[email protected] ships no library code — only a package.json whose `preinstall` script runs `/usr/bin/curl` to https://bxss.boll-sec.de/callb with base64-encoded values of `uname -n`, `ls` of the current directory, and `whoami` as query parameters. This fires automatically on `npm install`, sending the installer's hostname, working-directory listing, and username to an external, non-first-party host. The scope name resembles an internal United Airlines organization and the package contains no functional code beyond the beacon, matching the dependency-confusion pattern in which resolution of an internal package name pulls in an attacker-published public artifact.

References: https://www.npmjs.com/package/@united-airlines-org/atmos-design-system/v/41.0.0, https://www.npmjs.com/package/@united-airlines-org/atmos-design-system/v/40.0.0