MAL-2026-6972
Dashboard / Malicious Package / MAL-2026-6972
MAL-2026-6972
Summary: Malicious code in @vwfs-its/sf-sac-frontend (npm)
Details: Source: amazon-inspector (41fd62df844e3fba17cb6200b0c9f2ce518a630677ed96f4cf0349b2a3eb7a3d) On `npm install`, the package's preinstall hook (`node index.js`) collects installer host identity — hostname, OS user info, output of `whoami` and `id`, shell, home directory, platform, and current working directory — and POSTs the JSON payload to a hardcoded Burp Collaborator subdomain at https://rsnchacyin4dnjv0oc8prrwn1e77vzjo.oastify.com/detox56. The package ships under an internal-looking scope (@vwfs-its) with empty author/description/license metadata and no functional code beyond the recon beacon, matching the shape of a targeted dependency-confusion attack: publish a public package that mirrors an internal name so that a misconfigured resolver in the target's build environment pulls the public copy and executes the payload during install. Source: ossf-package-analysis (2e08b57aacea0c5dcc883413eddf7737e7a45fa2c21bd5381d4e80235b3ef182) The OpenSSF Package Analysis project identified '@vwfs-its/sf-sac-frontend' @ 20.1.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.
Affected packages
Package
Name: @vwfs-its/sf-sac-frontend
Purl: pkg:npm/%40vwfs-its/sf-sac-frontend
Affected ranges
Type: N/A
Events:
