Malicious Code Detected in atm_bmw Package: Version 2.0.1 Compromised
Summary
MAL-2026-34: Malicious code in atm_bmw (npm). Affects atm_bmw versions 2.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The atm_bmw package, available through npm, is designed for specific functionalities related to BMW vehicle management. It is utilized by developers to integrate features into applications that interact with BMW systems. However, version 2.0.1 of this package has been flagged for malicious behavior, raising concerns about its integrity and security.
Vulnerability Detail
The atm_bmw package version 2.0.1 has been identified as malicious due to its communication with a domain linked to malicious activities. This vulnerability poses significant risks, including potential data breaches, unauthorized access to user information, and exploitation of the application's functionality for harmful purposes. The origin of this vulnerability stems from the package's design to connect with external domains that are known for malicious intent.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall atm_bmwIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate the risks associated with the atm_bmw package. Users are advised to avoid using this package until a secure version is released.
Conclusion
The atm_bmw package version 2.0.1 has been flagged for malicious activity, necessitating immediate action from users to protect their applications. It is essential to uninstall this package and seek alternatives to ensure the security of your software.
See every vulnerability recorded for atm_bmw →
FAQ
The atm_bmw package is an npm package used for integrating functionalities related to BMW vehicle management into applications.
Version 2.0.1 of atm_bmw is considered malicious because it communicates with a domain associated with malicious activities, posing security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
You should uninstall the atm_bmw package immediately and look for a secure alternative, as there is no patched version available at this time.
While specific alternatives are not mentioned, it is advisable to research other npm packages that provide similar functionalities without the associated risks.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
