The @marketfront/blenderdevtool package at version 7.0.0 was maliciously published as part of a batch campaign on 2026-07-01. It includes a heavily obfuscated postinstall hook that executes automatically during npm install, harvesting approximately 20 sensitive credential files such as SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm tokens, and environment files. The stolen data is compressed and exfiltrated over HTTPS with a custom header and also via recursive DNS queries to evade network filtering. The command-and-control infrastructure is concealed using RC4 and XOR encryption layers. The package implements anti-analysis checks to detect debuggers and virtual machines, preventing execution in sandboxed environments. The campaign shares tooling and infrastructure patterns with a previous campaign, indicating a persistent threat actor rotating npm scopes and maintainer identities. The package metadata and README falsely claim it is an internal telemetry tool, aiming to exploit dependency confusion attacks in targeted organizations. There is no CVSS score or known exploits in the wild reported yet.

Successful installation of this package leads to the compromise of sensitive credentials and environment information from the host system, including SSH keys, cloud service credentials, container and Kubernetes configs, and other secrets. This data exfiltration can enable attackers to gain unauthorized access to various internal and cloud resources, potentially leading to further compromise of the victim's infrastructure. The anti-analysis features reduce the likelihood of detection during automated scans or sandboxed installs, increasing the risk of stealthy compromise. The use of dependency confusion techniques suggests targeted attacks against organizations relying on internal @marketfront scoped packages.

No official patch or remediation is currently available for this malicious package. Users and organizations should immediately audit their dependency trees for the presence of @marketfront/blenderdevtool version 7.0.0 and remove it if found. Avoid installing packages from untrusted or suspicious npm scopes, especially those mimicking internal organizational packages. Implement strict controls on npm package sources and consider using package allowlists or internal registries to prevent dependency confusion attacks. Monitor for unusual network activity indicative of credential exfiltration. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.