OpenSSF/OSV advisory MAL-2026-13435 confirms this npm version as malicious. Package @united-airlines-org/atmos-design-system@41.0.0 ships no library code — only a package.json whose `preinstall` script runs `/usr/bin/curl` to https://bxss.boll-sec.de/callb with base64-encoded values of `uname -n`, `ls` of the current directory, and `whoami` as query parameters...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @united-airlines-org/atmos-design-system (npm)
Details
Package @united-airlines-org/atmos-design-system@41.0.0 ships no library code — only a package.json whose `preinstall` script runs `/usr/bin/curl` to https://bxss.boll-sec.de/callb with base64-encoded values of `uname -n`, `ls` of the current directory, and `whoami` as query parameters. This fires automatically on `npm install`, sending the installer's hostname, working-directory listing, and username to an external, non-first-party host. The scope name resembles an internal United Airlines organization and the package contains no functional code beyond the beacon, matching the dependency-confusion pattern in which resolution of an internal package name pulls in an attacker-published public artifact.
Decision reason
OpenSSF Malicious Packages via OSV confirms @united-airlines-org/atmos-design-system@41.0.0 as malicious (MAL-2026-13435): Malicious code in @united-airlines-org/atmos-design-system (npm)