The package @united-airlines-org/atmos-design-system (versions 40.0.0 and 41.0.0) includes a malicious preinstall script in its package.json that runs on npm install. This script uses curl to send base64-encoded hostname (from uname -n), directory listing (ls), and current username (whoami) to a remote attacker-controlled endpoint at https://bxss.boll-sec.de. The package contains no functional library code beyond this beaconing behavior. The package name mimics an internal United Airlines package, consistent with a dependency confusion attack where an attacker publishes a malicious package under an internal namespace to capture reconnaissance data from victims installing the package.

The malicious preinstall script leaks sensitive host reconnaissance data (hostname, directory contents, username) to an external attacker-controlled server during package installation. This can lead to information disclosure and potentially facilitate further targeted attacks. The package does not contain functional code but acts as a beacon to gather environment details from victims.

No official patch or remediation is currently documented. Users should avoid installing the package @united-airlines-org/atmos-design-system versions 40.0.0 and 41.0.0. Verify package sources carefully to prevent dependency confusion attacks, especially for internal or scoped packages. Monitor for updates from the package publisher or vendor for any remediation announcements. Patch status is not yet confirmed — check the vendor advisory or trusted sources for current remediation guidance.