@united-airlines-org/atmos-design-system@40.0.0

Analysis

The package's preinstall hook runs curl against the attacker-controlled host bxss[.]boll-sec[.]de, appending the machine's hostname base64-encoded as a URL path segment (hostname_<base64>). On every install it exfiltrates the hostname of the installing machine to this remote host. The package ships no code, README, or license — only the malicious install hook.