Dependency confusion: @atfm npm packages exfiltrate builder host info to callback.m0chan.co.uk on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
Two npm packages, @atfm/atfm-material-ui and @atfm/utils, both at version 99.99.99, were published as dependency-confusion malware. The inflated version numbers ensure that builds resolving internal @atfm-scoped packages pick the public malicious ones. Their preinstall scripts run on npm install, base64-encoding the installing user, hostname, working directory and package name, then exfiltrating the data via an HTTPS GET to a subdomain of callback.m0chan.co.uk and via a DNS lookup with the encoded package name as a subdomain label. The same script appears in other packages in the campaign calling back to the same domain. Any CI or developer machine that installed these packages leaked host information. Both packages have been removed from npm; there are no patched versions, so remediation means removing the packages and auditing installs.
What to do
- Audit npm install logs and lockfiles for @atfm/atfm-material-ui or @atfm/utils at 99.99.99 and any installs resolving to callback.m0chan.co.uk
- Treat any machine or CI runner that installed them as compromised; investigate and rotate credentials used there
- Block the domain callback.m0chan.co.uk and its subdomains in DNS and egress filtering
- Configure npm scope mapping (.npmrc) so internal @atfm packages only resolve from the private registry
- Enable npm audit and registry allowlists / ignore-scripts to prevent preinstall execution from unknown packages
Sources
All live incidents on Threat Watch
