Malicious code in @marketfront/devtoolsloader (npm)
The @marketfront/devtoolsloader npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time frame. It contains a heavily obfuscated postinstall script that executes automatically during npm install, harvesting sensitive credentials and environment data from developer machines. The harvested data includes SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm and git credentials, shell history, and environment variables. This data is exfiltrated via encrypted HTTPS POST requests and DNS queries to attacker-controlled infrastructure. The package contains no legitimate functionality and is designed to lure developers expecting internal corporate packages. The campaign shares infrastructure and tactics with a previous malicious campaign, indicating a recurring threat actor. No CVSS score is assigned, but the impact is severe due to credential theft and potential compromise of developer environments.
AI Analysis
Technical Summary
The @marketfront/devtoolsloader package (version 7.0.0) is a malicious npm package published as part of a 25-package campaign under the @marketfront scope. It includes a heavily obfuscated postinstall script (scripts/postinstall.js) that executes automatically during npm install. The script performs sandbox evasion checks and then collects extensive sensitive information from the host, including environment variables, host identifiers, and approximately 20 credential-related files such as ~/.ssh, ~/.aws/credentials, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.netrc, ~/.pgpass, ~/.git-credentials, ~/.env, and shell history files. The collected data is compressed and exfiltrated via HTTPS POST requests with a custom X-Secret header and DNS beaconing to a command-and-control server concealed by RC4+XOR encryption. The package contains no functional code and is a dependency confusion lure targeting developers expecting internal packages. The campaign shares tooling and infrastructure patterns with a previous @emcd-vue campaign, indicating the same threat actor. No official patch or remediation is documented.
Potential Impact
Installation of this package on developer or CI machines results in the exfiltration of sensitive credentials, environment variables, host identity information, and shell history to attacker-controlled infrastructure. This can lead to compromise of developer accounts, cloud resources, source code repositories, and other sensitive systems accessible via stolen credentials. The malicious payload evades sandbox detection and only activates on real developer environments, increasing the risk of targeted credential theft and subsequent attacks.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove the @marketfront/devtoolsloader package version 7.0.0 from their projects and audit their environments for potential credential exposure. Avoid installing packages from untrusted or unknown npm scopes, especially those mimicking internal corporate packages. Monitor for suspicious network activity related to HTTPS POST requests or DNS queries to unknown endpoints. Consider rotating any potentially exposed credentials and secrets. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.
Malicious code in @marketfront/devtoolsloader (npm)
Description
The @marketfront/devtoolsloader npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time frame. It contains a heavily obfuscated postinstall script that executes automatically during npm install, harvesting sensitive credentials and environment data from developer machines. The harvested data includes SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm and git credentials, shell history, and environment variables. This data is exfiltrated via encrypted HTTPS POST requests and DNS queries to attacker-controlled infrastructure. The package contains no legitimate functionality and is designed to lure developers expecting internal corporate packages. The campaign shares infrastructure and tactics with a previous malicious campaign, indicating a recurring threat actor. No CVSS score is assigned, but the impact is severe due to credential theft and potential compromise of developer environments.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @marketfront/devtoolsloader package (version 7.0.0) is a malicious npm package published as part of a 25-package campaign under the @marketfront scope. It includes a heavily obfuscated postinstall script (scripts/postinstall.js) that executes automatically during npm install. The script performs sandbox evasion checks and then collects extensive sensitive information from the host, including environment variables, host identifiers, and approximately 20 credential-related files such as ~/.ssh, ~/.aws/credentials, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.netrc, ~/.pgpass, ~/.git-credentials, ~/.env, and shell history files. The collected data is compressed and exfiltrated via HTTPS POST requests with a custom X-Secret header and DNS beaconing to a command-and-control server concealed by RC4+XOR encryption. The package contains no functional code and is a dependency confusion lure targeting developers expecting internal packages. The campaign shares tooling and infrastructure patterns with a previous @emcd-vue campaign, indicating the same threat actor. No official patch or remediation is documented.
Potential Impact
Installation of this package on developer or CI machines results in the exfiltration of sensitive credentials, environment variables, host identity information, and shell history to attacker-controlled infrastructure. This can lead to compromise of developer accounts, cloud resources, source code repositories, and other sensitive systems accessible via stolen credentials. The malicious payload evades sandbox detection and only activates on real developer environments, increasing the risk of targeted credential theft and subsequent attacks.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove the @marketfront/devtoolsloader package version 7.0.0 from their projects and audit their environments for potential credential exposure. Avoid installing packages from untrusted or unknown npm scopes, especially those mimicking internal corporate packages. Monitor for suspicious network activity related to HTTPS POST requests or DNS queries to unknown endpoints. Consider rotating any potentially exposed credentials and secrets. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6774
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4c348527e9c7971960741f
Added to database: 07/06/2026, 23:04:37 UTC
Last enriched: 07/06/2026, 23:39:53 UTC
Last updated: 07/27/2026, 12:39:47 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.