This threat involves a malicious npm package, @marketfront/advertisingdevtool version 7.0.0, which executes an obfuscated postinstall script upon installation. The script collects extensive host reconnaissance data and reads approximately 20 sensitive credential files from the user's home directory. It encrypts and exfiltrates this data via two channels: an HTTPS POST with a custom X-Secret header and a DNS tunnel using encrypted subdomain labels. The package employs anti-debugging and anti-analysis checks to avoid detection. This campaign shares infrastructure and tooling with a previous campaign (@emcd-vue), indicating a recurring threat actor rotating scopes and maintainer identities. The package masquerades as an internal configuration loader with fake internal URLs to mislead victims.

The impact is the unauthorized collection and exfiltration of a wide range of sensitive credentials and environment data from infected hosts. This can lead to credential compromise, unauthorized access to cloud services, source code repositories, container registries, and other critical infrastructure. The anti-analysis features increase the difficulty of detection and analysis, potentially allowing prolonged undetected compromise.

No official patch or fix is available for this malicious package. The package should be considered malicious and removed immediately if found in any environment. Users and organizations should audit their dependencies for the presence of @marketfront/advertisingdevtool version 7.0.0 and any other packages from the @marketfront scope published on 2026-07-01 at version 7.0.0. Avoid installing or using these packages. Implement strict supply chain security practices such as verifying package provenance and using trusted registries. Monitor for suspicious network activity related to exfiltration channels described. Since this is a malicious package, remediation involves removal and credential rotation for any potentially compromised secrets.