The npm package @united-airlines-org/atmos-design-system contains a malicious preinstall script that executes automatically during installation. This script exfiltrates host information including the machine's hostname, current directory listing, and username to an attacker-controlled external server. The package contains no legitimate code and appears to be a dependency confusion attack targeting an internal United Airlines package namespace. Versions 40.0.0 and 41.0.0 are affected.