Malicious code in @marketfront/captchaservice (npm)
The @marketfront/captchaservice package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' ([email protected]) within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use e-commerce/marketing frontend component names as cover. The package declares a postinstall hook (node scripts/postinstall.js) that executes heavily obfuscated (obfuscator.io-style) code automatically at npm install time. Static analysis of the decoded payload revealed a credential harvester that dynamically requires fs, os, http, https, zlib, path and dns, then reads approximately 20 sensitive credential files including ~/.ssh, ~/.aws/credentials, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.netrc, ~/.pgpass, ~/.git-credentials, ~/.env and ~/.bash_history. Collected data is exfiltrated via a gzip-compressed HTTPS POST with a custom X-Secret header to the path /api/v1/events, alongside a DNS resolver beacon. The command-and-control host is concealed behind an additional RC4+XOR encryption layer around an embedded configuration blob and was not statically resolved. The decoded behavioral payload (module requires, credential-file target list, exfiltration headers and endpoint) is byte-for-byte identical across sampled packages in the campaign. The campaign shares tooling and infrastructure patterns (obfuscated postinstall credential harvester, X-Secret header, /api/v1/events exfiltration path, RC4-concealed C2) with the earlier @emcd-vue campaign, indicating the same actor rotating scopes and disposable maintainer emails. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8cd0b252facfe0d6e08c857f30067c00ba09b8423773b1181d6ce78ebba8b749) Package @marketfront/[email protected] could not be fully characterized from automated evidence. No a static rule findings are recorded, and while automated code tracing engaged and read files from the package, its output was withheld by the provider's malware-content safety filter — a signal that the traced content resembled operational malware but which does not, on its own, identify a specific installer-harm mechanism (exfil endpoint, credential path, dropper URL, backdoor). Without a named data source, named destination, or named install/import-time execution path, the record does not meet the bar for a public block verdict. The scope (`@marketfront`) and package name (`captchaservice`) do not correspond to a known-legitimate widely-used package family, and the safety-filter trigger warrants a human look at the tarball contents before this version is trusted in a build pipeline.
AI Analysis
Technical Summary
The @marketfront/captchaservice package at version 7.0.0 was published as part of a batch of 25 malicious npm packages under the @marketfront scope. It includes a postinstall hook running heavily obfuscated code that harvests sensitive credential files such as SSH keys, AWS credentials, Kubernetes config, Docker config, npm credentials, and others. The harvested data is compressed and exfiltrated over HTTPS with custom headers to a concealed command-and-control server, protected by additional encryption layers. This campaign shares tooling and infrastructure patterns with a previous @emcd-vue campaign, suggesting the same threat actor rotating npm scopes and maintainer identities. Automated analysis flagged the package as operational malware, but no official patch or fix is available.
Potential Impact
If installed, this package can compromise a developer's or build environment by stealing a wide range of sensitive credentials and configuration files. This can lead to unauthorized access to cloud services, source code repositories, container registries, and other critical infrastructure. The exfiltration is stealthy, using encrypted channels and obfuscated payloads, increasing the risk of undetected credential theft.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package. The best mitigation is to avoid installing @marketfront/captchaservice version 7.0.0 and any other packages from the @marketfront scope published in this campaign. Conduct manual inspection of package contents before use. Use trusted package sources and implement supply chain security measures such as package signing and integrity verification. Monitor for and remove any instances of this package in build pipelines or environments.
Malicious code in @marketfront/captchaservice (npm)
Description
The @marketfront/captchaservice package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' ([email protected]) within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use e-commerce/marketing frontend component names as cover. The package declares a postinstall hook (node scripts/postinstall.js) that executes heavily obfuscated (obfuscator.io-style) code automatically at npm install time. Static analysis of the decoded payload revealed a credential harvester that dynamically requires fs, os, http, https, zlib, path and dns, then reads approximately 20 sensitive credential files including ~/.ssh, ~/.aws/credentials, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.netrc, ~/.pgpass, ~/.git-credentials, ~/.env and ~/.bash_history. Collected data is exfiltrated via a gzip-compressed HTTPS POST with a custom X-Secret header to the path /api/v1/events, alongside a DNS resolver beacon. The command-and-control host is concealed behind an additional RC4+XOR encryption layer around an embedded configuration blob and was not statically resolved. The decoded behavioral payload (module requires, credential-file target list, exfiltration headers and endpoint) is byte-for-byte identical across sampled packages in the campaign. The campaign shares tooling and infrastructure patterns (obfuscated postinstall credential harvester, X-Secret header, /api/v1/events exfiltration path, RC4-concealed C2) with the earlier @emcd-vue campaign, indicating the same actor rotating scopes and disposable maintainer emails. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8cd0b252facfe0d6e08c857f30067c00ba09b8423773b1181d6ce78ebba8b749) Package @marketfront/[email protected] could not be fully characterized from automated evidence. No a static rule findings are recorded, and while automated code tracing engaged and read files from the package, its output was withheld by the provider's malware-content safety filter — a signal that the traced content resembled operational malware but which does not, on its own, identify a specific installer-harm mechanism (exfil endpoint, credential path, dropper URL, backdoor). Without a named data source, named destination, or named install/import-time execution path, the record does not meet the bar for a public block verdict. The scope (`@marketfront`) and package name (`captchaservice`) do not correspond to a known-legitimate widely-used package family, and the safety-filter trigger warrants a human look at the tarball contents before this version is trusted in a build pipeline.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @marketfront/captchaservice package at version 7.0.0 was published as part of a batch of 25 malicious npm packages under the @marketfront scope. It includes a postinstall hook running heavily obfuscated code that harvests sensitive credential files such as SSH keys, AWS credentials, Kubernetes config, Docker config, npm credentials, and others. The harvested data is compressed and exfiltrated over HTTPS with custom headers to a concealed command-and-control server, protected by additional encryption layers. This campaign shares tooling and infrastructure patterns with a previous @emcd-vue campaign, suggesting the same threat actor rotating npm scopes and maintainer identities. Automated analysis flagged the package as operational malware, but no official patch or fix is available.
Potential Impact
If installed, this package can compromise a developer's or build environment by stealing a wide range of sensitive credentials and configuration files. This can lead to unauthorized access to cloud services, source code repositories, container registries, and other critical infrastructure. The exfiltration is stealthy, using encrypted channels and obfuscated payloads, increasing the risk of undetected credential theft.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package. The best mitigation is to avoid installing @marketfront/captchaservice version 7.0.0 and any other packages from the @marketfront scope published in this campaign. Conduct manual inspection of package contents before use. Use trusted package sources and implement supply chain security measures such as package signing and integrity verification. Monitor for and remove any instances of this package in build pipelines or environments.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6769
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50ba5c68715ace4357effa
Added to database: 07/10/2026, 09:24:44 UTC
Last enriched: 07/10/2026, 09:45:41 UTC
Last updated: 07/30/2026, 09:32:48 UTC
Views: 31
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.