MalwarePublished 2 Jul 2026Updated 6 Jul 2026

@marketfront/baobabtech (npm) · Malicious Code

Affects @marketfront/baobabtechSource GCVE Database

Malicious package : remove @marketfront/baobabtech and rotate any secrets on hosts that installed it.

Data as of 6 Jul 2026, 23:40 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6766

What to do

Remove @marketfront/baobabtech from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@marketfront/baobabtech	Affected =7.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @marketfront/baobabtech npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time frame. It contains a heavily obfuscated postinstall script that executes automatically during npm install. This script harvests sensitive credentials and environment information from the host, including SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm and git credentials, and various environment variables. The stolen data is exfiltrated via a compressed HTTPS POST request to a concealed command-and-control server. The campaign shares infrastructure and techniques with a prior malicious campaign, indicating a recurring threat actor. This package falsely advertises itself as a database utility but performs unauthorized credential theft at install time.

Impact

Installation of @marketfront/baobabtech version 7.0.0 results in automatic execution of malicious code that steals a wide range of sensitive credentials and environment data from the host system. This can lead to credential compromise across multiple services (SSH, AWS, Kubernetes, Docker, npm, git, databases, etc.), potentially enabling unauthorized access, lateral movement, and further compromise of development and production environments. The exfiltration of this data to a concealed command-and-control server facilitates attacker persistence and exploitation.

Defensive guidance

The package should be considered malicious and immediately removed from any projects or environments where it is installed. Avoid installing packages from the @marketfront npm scope or any packages published by the user 'marketfront' until further notice. Employ strict package source verification and supply chain security controls to prevent installation of untrusted or suspicious packages. Monitor for presence of this package and related artifacts in development and build environments.

Summary

The @marketfront/baobabtech package at version 7.0.0 includes a postinstall lifecycle hook that runs an obfuscated ~160 KB payload encoded with obfuscator.io and protected by RC4/XOR encryption and anti-analysis checks. Upon installation, it collects extensive environment and system information, reads approximately 20 sensitive credential files from the filesystem, and exfiltrates this data via a gzip-compressed HTTPS POST request with a custom X-Secret header to a hidden API endpoint. The command-and-control infrastructure is concealed behind additional encryption layers. This behavior is consistent across all packages in the campaign and matches patterns from a previous campaign under a different npm scope, indicating the same attacker rotating scopes and maintainer identities. The package’s advertised functionality does not justify such extensive data collection, confirming malicious intent.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Jul 2026, 23:40 UTC

Technical details

References

Community reviews