@vwfs-its/sf-sac-frontendnpm
Advisory published Updated
@vwfs-its/sf-sac-frontend is a confirmed malicious npm package (MAL-2026-6972) that opens a backdoor for remote access (malicious version 20.1.1). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @vwfs-its/sf-sac-frontend (npm)
What this malware does
On npm install, the package's preinstall hook (node index.js) collects installer host identity — hostname, OS user info, output of whoami and id, shell, home directory, platform, and current working directory — and POSTs the JSON payload to a hardcoded Burp Collaborator subdomain at https://rsnchacyin4dnjv0oc8prrwn1e77vzjo.oastify.com/detox56. The package ships under an internal-looking scope (@vwfs-its) with empty author/description/license metadata and no functional code beyond the recon beacon, matching the shape of a targeted dependency-confusion attack: publish a public package that mirrors an internal name so that a misconfigured resolver in the target's build environment pulls the public copy and executes the payload during install.
The OpenSSF Package Analysis project identified '@vwfs-its/sf-sac-frontend' @ 20.1.1 (npm) as malicious.
It is considered malicious because:
-
The package communicates with a domain associated with malicious activity.
-
The package executes one or more commands associated with malicious behavior.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Backdoor / remote accessFind it
Search your lockfiles and build artifacts for @vwfs-its/sf-sac-frontend (version 20.1.1).
If you installed it — respond
@vwfs-its/sf-sac-frontend establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If @vwfs-its/sf-sac-frontend was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- OpenSSF: Package Analysis · finder
Detect & block this
O3 blocks @vwfs-its/sf-sac-frontend-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.