The @marketfront/designsystemdevtool package (version 7.0.0) was published as part of a 25-package malicious campaign on 2026-07-01 under the npm user 'marketfront'. It contains a heavily obfuscated postinstall hook that runs automatically at npm install time, executing a credential harvester. This harvester dynamically loads core Node.js modules and reads approximately 20 sensitive credential files and environment variables, including SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm and git credentials, and shell history. The collected data is compressed and exfiltrated over HTTPS with a custom header and also uses DNS tunneling as a fallback. The command-and-control server address is concealed via RC4+XOR encryption. The package is a public-registry impersonation of a private Marketfront scope and contains no legitimate library code. It performs runtime environment checks to evade debugging and instrumentation. This campaign shares tooling and infrastructure patterns with a previous malicious campaign (@emcd-vue), indicating the same threat actor rotating scopes and maintainer emails. No CVSS score or official patch is available.

Systems that install this package version 7.0.0 will have sensitive credentials and environment information silently harvested and exfiltrated to attacker-controlled infrastructure during npm install. This includes private keys, cloud credentials, configuration files, environment variables (potentially containing CI tokens and internal URLs), and shell history. This can lead to credential compromise, unauthorized access to cloud and internal resources, and further system compromise. The malicious code executes automatically without user interaction beyond installing the package, increasing risk in CI/CD pipelines and developer environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal from the npm registry is confirmed, avoid installing or updating to version 7.0.0 of @marketfront/designsystemdevtool from the public npm registry. Verify package sources carefully, especially for scoped packages that may impersonate private registries. Use private registries as intended and audit dependencies for unexpected postinstall scripts. Consider scanning existing environments for signs of this package and related malicious activity.