MalwarePublished 2 Jul 2026Updated 6 Jul 2026

@marketfront/customdealsfeed (npm) · Malicious Code

Affects @marketfront/customdealsfeedSource GCVE Database

Malicious package : remove @marketfront/customdealsfeed and rotate any secrets on hosts that installed it.

Data as of 6 Jul 2026, 23:40 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6772

What to do

Remove @marketfront/customdealsfeed from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@marketfront/customdealsfeed	Affected =7.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @marketfront/customdealsfeed npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time window. It contains a heavily obfuscated postinstall script that executes automatically during npm install, harvesting sensitive credential files from the host and exfiltrating them via encrypted HTTPS requests and DNS beacons. The package has no legitimate runtime code and uses sandbox evasion techniques to avoid detection. This campaign reuses tooling and infrastructure from a previous malicious campaign, indicating a persistent threat actor. The package also attempts dependency confusion by instructing users to add a fake registry URL in .npmrc, potentially targeting organizations with misconfigured internal scopes.

Impact

Installation of this package results in automatic execution of malicious code that harvests sensitive credentials and environment information from the host system. This can lead to credential theft, unauthorized access to cloud services, source code repositories, and other sensitive resources. The exfiltration methods are designed to bypass network defenses, increasing the risk of undetected data leakage. The package does not provide any legitimate functionality and is solely designed for credential harvesting and data exfiltration.

Defensive guidance

The package should be considered malicious and untrusted. Users and organizations should avoid installing @marketfront/customdealsfeed version 7.0.0 and any other packages from the @marketfront scope published in this campaign. Review and remove any instances of these packages from projects and dependency trees. Do not add or trust the suggested registry URL (https://npm.marketfront.io) as it points to non-existent infrastructure and is part of a dependency confusion lure. Implement strict package source verification and pinning to prevent dependency confusion attacks. Monitor for and remove any unauthorized credentials that may have been exposed if this package was installed.

Summary

The @marketfront/customdealsfeed package (version 7.0.0) is malicious software published to the npm registry as part of a batch campaign. It contains an obfuscated postinstall hook script that runs automatically on installation, harvesting approximately 20 types of sensitive credential files (e.g., SSH keys, AWS credentials, Kubernetes config, Docker config, npm credentials, git credentials, environment files, and shell history). The harvested data is compressed, encrypted, and exfiltrated over HTTPS to a concealed command-and-control endpoint, with additional DNS-based data exfiltration to evade network filtering. The package lacks legitimate runtime code, and the postinstall script includes sandbox evasion to avoid execution in analysis environments. The campaign shares infrastructure and code patterns with a previous malicious npm campaign (@emcd-vue), indicating the same threat actor. The package also attempts to lure organizations into dependency confusion attacks by recommending a non-existent private npm registry URL.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Jul 2026, 23:40 UTC

Technical details

References

Community reviews