@united-airlines-org/atmos-design-system (npm) · Malicious Code
Affects @united-airlines-org/atmos-design-systemSource GCVE Database
Malicious package : remove @united-airlines-org/atmos-design-system and rotate any secrets on hosts that installed it.
Data as of 7 Aug 2026, 07:43 UTC
Malicious package
Published to npm · OSV MAL-2026-13435
What to do
Remove @united-airlines-org/atmos-design-system from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@united-airlines-org/atmos-design-system | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package @united-airlines-org/atmos-design-system contains a malicious preinstall script that executes automatically during installation. This script exfiltrates host information including the machine's hostname, current directory listing, and username to an attacker-controlled external server. The package contains no legitimate code and appears to be a dependency confusion attack targeting an internal United Airlines package namespace. Versions 40.0.0 and 41.0.0 are affected.