MAL-2026-13435 Malicious code in @united-airlines-org/atmos-design-system (npm)

The package @united-airlines-org/atmos-design-system contains a malicious preinstall script in its package.json that runs automatically during installation. The script executes curl to send the machine's hostname, obtained via uname -n and base64-encoded, to the attacker-controlled endpoint https://bxss.boll-sec.de/hostname_<base64-hostname>. This exfiltrates host reconnaissance data to a remote server. All versions of the package are malicious.

Package @united-airlines-org/[email protected] ships no library code — only a package.json whose preinstall script runs /usr/bin/curl to https://bxss.boll-sec.de/callb with base64-encoded values of uname -n, ls of the current directory, and whoami as query parameters. This fires automatically on npm install, sending the installer's hostname, working-directory listing, and username to an external, non-first-party host. The scope name resembles an internal United Airlines organization and the package contains no functional code beyond the beacon, matching the dependency-confusion pattern in which resolution of an internal package name pulls in an attacker-published public artifact.