MalwarePublished 2 Jul 2026Updated 6 Jul 2026

@marketfront/blenderdevtool (npm) · Malicious Code

Affects @marketfront/blenderdevtoolSource GCVE Database

Malicious package : remove @marketfront/blenderdevtool and rotate any secrets on hosts that installed it.

Data as of 6 Jul 2026, 23:40 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6768

What to do

Remove @marketfront/blenderdevtool from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@marketfront/blenderdevtool	Affected =7.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @marketfront/blenderdevtool npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within minutes under the @marketfront scope. It contains an obfuscated postinstall script that harvests sensitive credential files and environment data from the host system and exfiltrates this information via encrypted HTTPS POST requests and DNS queries to a concealed command-and-control server. The package uses anti-analysis techniques to evade detection in sandboxed or instrumented environments. The campaign mimics legitimate internal packages to exploit dependency confusion in targeted organizations' build pipelines. No official patch or remediation guidance is currently available.

Impact

Successful installation of this package leads to the compromise of sensitive credentials and environment information from the host system, including SSH keys, cloud service credentials, container and Kubernetes configs, and other secrets. This data exfiltration can enable attackers to gain unauthorized access to various internal and cloud resources, potentially leading to further compromise of the victim's infrastructure. The anti-analysis features reduce the likelihood of detection during automated scans or sandboxed installs, increasing the risk of stealthy compromise. The use of dependency confusion techniques suggests targeted attacks against organizations relying on internal @marketfront scoped packages.

Defensive guidance

Users and organizations should immediately audit their dependency trees for the presence of @marketfront/blenderdevtool version 7.0.0 and remove it if found. Avoid installing packages from untrusted or suspicious npm scopes, especially those mimicking internal organizational packages. Implement strict controls on npm package sources and consider using package allowlists or internal registries to prevent dependency confusion attacks. Monitor for unusual network activity indicative of credential exfiltration.

Summary

The @marketfront/blenderdevtool package at version 7.0.0 was maliciously published as part of a batch campaign on 2026-07-01. It includes a heavily obfuscated postinstall hook that executes automatically during npm install, harvesting approximately 20 sensitive credential files such as SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm tokens, and environment files. The stolen data is compressed and exfiltrated over HTTPS with a custom header and also via recursive DNS queries to evade network filtering. The command-and-control infrastructure is concealed using RC4 and XOR encryption layers. The package implements anti-analysis checks to detect debuggers and virtual machines, preventing execution in sandboxed environments. The campaign shares tooling and infrastructure patterns with a previous campaign, indicating a persistent threat actor rotating npm scopes and maintainer identities. The package metadata and README falsely claim it is an internal telemetry tool, aiming to exploit dependency confusion attacks in targeted organizations. There is no CVSS score or known exploits in the wild reported yet.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Jul 2026, 23:40 UTC

Technical details

References

Community reviews