@vwfs-its/sf-sac-frontend (npm) · Malicious Code
Affects @vwfs-its/sf-sac-frontendSource GCVE Database
Malicious package : remove @vwfs-its/sf-sac-frontend and rotate any secrets on hosts that installed it.
Data as of 10 Jul 2026, 09:29 UTC
Malicious package
Published to npm · OSV MAL-2026-6972
What to do
Remove @vwfs-its/sf-sac-frontend from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@vwfs-its/sf-sac-frontend | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (41fd62df844e3fba17cb6200b0c9f2ce518a630677ed96f4cf0349b2a3eb7a3d) On `npm install`, the package's preinstall hook (`node index.js`) collects installer host identity — hostname, OS user info, output of `whoami` and `id`, shell, home directory, platform, and current working directory — and POSTs the JSON payload to a hardcoded Burp Collaborator subdomain at https://rsnchacyin4dnjv0oc8prrwn1e77vzjo.oastify.com/detox56. The package ships under an internal-looking scope (@vwfs-its) with empty author/description/license metadata and no functional code beyond the recon beacon, matching the shape of a targeted dependency-confusion attack: publish a public package that mirrors an internal name so that a misconfigured resolver in the target's build environment pulls the public copy and executes the payload during install. ## Source: ossf-package-analysis (2e08b57aacea0c5dcc883413eddf7737e7a45fa2c21bd5381d4e80235b3ef182) The OpenSSF Package Analysis project identified '@vwfs-its/sf-sac-frontend' @ 20.1.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.