The @marketfront/customdealsfeed package (version 7.0.0) is malicious software published to the npm registry as part of a batch campaign. It contains an obfuscated postinstall hook script that runs automatically on installation, harvesting approximately 20 types of sensitive credential files (e.g., SSH keys, AWS credentials, Kubernetes config, Docker config, npm credentials, git credentials, environment files, and shell history). The harvested data is compressed, encrypted, and exfiltrated over HTTPS to a concealed command-and-control endpoint, with additional DNS-based data exfiltration to evade network filtering. The package lacks legitimate runtime code, and the postinstall script includes sandbox evasion to avoid execution in analysis environments. The campaign shares infrastructure and code patterns with a previous malicious npm campaign (@emcd-vue), indicating the same threat actor. The package also attempts to lure organizations into dependency confusion attacks by recommending a non-existent private npm registry URL.

Installation of this package results in automatic execution of malicious code that harvests sensitive credentials and environment information from the host system. This can lead to credential theft, unauthorized access to cloud services, source code repositories, and other sensitive resources. The exfiltration methods are designed to bypass network defenses, increasing the risk of undetected data leakage. The package does not provide any legitimate functionality and is solely designed for credential harvesting and data exfiltration.

No official patch or fix is available for this malicious package. The package should be considered malicious and untrusted. Users and organizations should avoid installing @marketfront/customdealsfeed version 7.0.0 and any other packages from the @marketfront scope published in this campaign. Review and remove any instances of these packages from projects and dependency trees. Do not add or trust the suggested registry URL (https://npm.marketfront.io) as it points to non-existent infrastructure and is part of a dependency confusion lure. Implement strict package source verification and pinning to prevent dependency confusion attacks. Monitor for and remove any unauthorized credentials that may have been exposed if this package was installed.