If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
The package @united-airlines-org/atmos-design-system contains a malicious `preinstall` script in its package.json that runs automatically during installation. The script executes `curl` to send the machine's hostname, obtained via `uname -n` and base64-encoded, to the attacker-controlled endpoint `https://bxss.boll-sec.de/hostname_<base64-hostname>`. This exfiltrates host reconnaissance data to a remote server. All versions of the package are malicious.
---
_-= Per source details. Do not edit below this line.=-_
Source: amazon-inspector (5683e7389b9b288024f2c9827c3649d7b291996625265f6365535121fc1f431a)
Package @united-airlines-org/atmos-design-system@41.0.0 ships no library code — only a package.json whose `preinstall` script runs `/usr/bin/curl` to https://bxss.boll-sec.de/callb with base64-encoded values of `uname -n`, `ls` of the current directory, and `whoami` as query parameters. This fires automatically on `npm install`, sending the installer's hostname, working-directory listing, and username to an external, non-first-party host. The scope name resembles an internal United Airlines organization and the package contains no functional code beyond the beacon, matching the dependency-confusion pattern in which resolution of an internal package name pulls in an attacker-published public artifact.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- bxss[.]boll-sec[.]de other packages →