MAL-2026-6972 Malicious code in @vwfs-its/sf-sac-frontend (npm)

On npm install, the package's preinstall hook (node index.js) collects installer host identity — hostname, OS user info, output of whoami and id, shell, home directory, platform, and current working directory — and POSTs the JSON payload to a hardcoded Burp Collaborator subdomain at https://rsnchacyin4dnjv0oc8prrwn1e77vzjo.oastify.com/detox56. The package ships under an internal-looking scope (@vwfs-its) with empty author/description/license metadata and no functional code beyond the recon beacon, matching the shape of a targeted dependency-confusion attack: publish a public package that mirrors an internal name so that a misconfigured resolver in the target's build environment pulls the public copy and executes the payload during install.

The OpenSSF Package Analysis project identified '@vwfs-its/sf-sac-frontend' @ 20.1.1 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.