MalwarePublished 2 Jul 2026Updated 6 Jul 2026

@marketfront/designsystemdevtool (npm) · Malicious Code

Affects @marketfront/designsystemdevtoolSource GCVE Database

Malicious package : remove @marketfront/designsystemdevtool and rotate any secrets on hosts that installed it.

Data as of 6 Jul 2026, 23:40 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6773

What to do

Remove @marketfront/designsystemdevtool from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@marketfront/designsystemdevtool	Affected =7.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @marketfront/designsystemdevtool npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short timeframe. It contains an obfuscated postinstall script that executes automatically during npm install, harvesting sensitive credentials and environment data from the host system. The stolen data includes SSH keys, cloud credentials, Docker and Kubernetes configs, npm and git credentials, environment variables, and shell history. This data is exfiltrated via HTTPS POST requests with additional DNS tunneling fallback to attacker-controlled infrastructure. The package impersonates an internal Marketfront scope but lacks legitimate functionality, serving solely as a credential stealer. The campaign shares infrastructure and techniques with a prior malicious campaign, indicating a persistent threat actor. No official patch or remediation is currently documented.

Impact

Systems that install this package version 7.0.0 will have sensitive credentials and environment information silently harvested and exfiltrated to attacker-controlled infrastructure during npm install. This includes private keys, cloud credentials, configuration files, environment variables (potentially containing CI tokens and internal URLs), and shell history. This can lead to credential compromise, unauthorized access to cloud and internal resources, and further system compromise. The malicious code executes automatically without user interaction beyond installing the package, increasing risk in CI/CD pipelines and developer environments.

Defensive guidance

Until an official fix or removal from the npm registry is confirmed, avoid installing or updating to version 7.0.0 of @marketfront/designsystemdevtool from the public npm registry. Verify package sources carefully, especially for scoped packages that may impersonate private registries. Use private registries as intended and audit dependencies for unexpected postinstall scripts. Consider scanning existing environments for signs of this package and related malicious activity.

Summary

The @marketfront/designsystemdevtool package (version 7.0.0) was published as part of a 25-package malicious campaign on 2026-07-01 under the npm user 'marketfront'. It contains a heavily obfuscated postinstall hook that runs automatically at npm install time, executing a credential harvester. This harvester dynamically loads core Node.js modules and reads approximately 20 sensitive credential files and environment variables, including SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm and git credentials, and shell history. The collected data is compressed and exfiltrated over HTTPS with a custom header and also uses DNS tunneling as a fallback. The command-and-control server address is concealed via RC4+XOR encryption. The package is a public-registry impersonation of a private Marketfront scope and contains no legitimate library code. It performs runtime environment checks to evade debugging and instrumentation. This campaign shares tooling and infrastructure patterns with a previous malicious campaign (@emcd-vue), indicating the same threat actor rotating scopes and maintainer emails. No CVSS score or official patch is available.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Jul 2026, 23:40 UTC

Technical details

References

Community reviews