@marketfront/devtoolsloader (npm) · Malicious Code
Affects @marketfront/devtoolsloaderSource GCVE Database
Malicious package : remove @marketfront/devtoolsloader and rotate any secrets on hosts that installed it.
Data as of 6 Jul 2026, 23:39 UTC
Malicious package
Published to npm · OSV MAL-2026-6774
What to do
Remove @marketfront/devtoolsloader from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@marketfront/devtoolsloader | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The @marketfront/devtoolsloader npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time frame. It contains a heavily obfuscated postinstall script that executes automatically during npm install, harvesting sensitive credentials and environment data from developer machines. The harvested data includes SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm and git credentials, shell history, and environment variables. This data is exfiltrated via encrypted HTTPS POST requests and DNS queries to attacker-controlled infrastructure. The package contains no legitimate functionality and is designed to lure developers expecting internal corporate packages. The campaign shares infrastructure and tactics with a previous malicious campaign, indicating a recurring threat actor. No CVSS score is assigned, but the impact is severe due to credential theft and potential compromise of developer environments.