The @marketfront/basemarkettemplate package (version 7.0.0) is a malicious npm package published as part of a 25-package batch under the @marketfront scope by a suspicious user. It includes a heavily obfuscated postinstall hook script that runs automatically on installation, collecting sensitive host credentials from files such as ~/.ssh, ~/.aws/credentials, ~/.kube/config, and others. The harvested data is compressed, encrypted, and exfiltrated over HTTPS POST requests with a custom header and via DNS tunneling. The command-and-control infrastructure is concealed with additional encryption layers. The package contains no legitimate functionality and is designed solely to deliver this credential-harvesting payload. The campaign shares characteristics with a prior malicious campaign targeting npm packages, suggesting the same threat actor is rotating scopes and maintainer identities.

Hosts that install this package version 7.0.0 risk having sensitive credential files exfiltrated to an attacker-controlled server. This includes SSH keys, AWS credentials, Kubernetes configs, Docker credentials, npm tokens, Git credentials, and shell histories, potentially leading to unauthorized access to cloud services, source code repositories, and other sensitive resources. The malicious code executes automatically during npm install without user interaction, increasing the risk of compromise in development and deployment environments.

No official patch or remediation is currently available for this malicious package. Users and organizations should avoid installing version 7.0.0 of @marketfront/basemarkettemplate and any other packages from the @marketfront scope published in this campaign. Audit existing dependencies for presence of these packages and remove them if found. Use trusted package sources and verify package maintainers before installation. Monitor for suspicious network activity related to credential exfiltration. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.