Which versions of node-vfs-polyfill are malicious?

The following npm versions of node-vfs-polyfill are flagged malicious: 2.0.5. Treat any of these as compromised.

How do I remediate node-vfs-polyfill if I installed it?

Remove node-vfs-polyfill from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound network activity or persistence. Use O3 Security's dependency scanner to confirm the package and its artifacts are fully purged across your stack.

Is node-vfs-polyfill part of a known attack campaign?

Yes — node-vfs-polyfill is associated with the IN-MAL-2026-007039 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

Can O3 Security detect node-vfs-polyfill in my codebase?

Yes. O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, blocking node-vfs-polyfill and packages like it before any post-install script runs.

Malicious package

node-vfs-polyfillnpm

Malicious code in node-vfs-polyfill (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-6143

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall node-vfs-polyfill

What this malware does

On install, postinstall.js executes automatically and exfiltrates host reconnaissance data to attacker-controlled subdomains on oastify.com (Burp Collaborator), a domain commonly used for out-of-band data exfiltration. The script imports http, https, os, and child_process; calls os.hostname() and execSync() to gather system identifiers; and POSTs the collected data — including hostname, username, and version fields — to hardcoded endpoints such as http://xxxxxxxxx.oastify.com and http://rni4z9qkil62r9dcwosokhtgo7u9i76w.oastify.com. The package name suggests a generic VFS polyfill but the postinstall does no polyfill work; its sole observable effect on npm install is system-info exfiltration. This matches the dependency-confusion / reconnaissance beacon pattern.

Malicious versions

1 flagged

2.0.5

Indicators of compromise (SHA-256)

7fb213e524ed75dcb54961d6d2ee9431ea6a32f4fdcb9d777bc260102920d81b

Frequently asked questions

No. node-vfs-polyfill on npm has been identified as a malicious package (version 2.0.5 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007039

References

npmjs.com

Credits

Amazon Inspector · finder

Scan your dependencies

O3 Security blocks malicious packages like this at install time and in CI.

Supply-chain protection