@marketfront/[email protected] is a malicious npm package published in a batch campaign under the @marketfront scope. It includes a postinstall hook executing a large obfuscated script that dynamically loads Node.js modules and reads approximately 20 sensitive credential files such as SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm tokens, and environment files. The harvested data is compressed, encrypted, and exfiltrated over HTTPS POST requests with custom headers and via DNS resolution queries to evade detection. The command-and-control server address is concealed with RC4 and XOR encryption. The payload also fingerprints the host environment and attempts to detect debugging or sandbox environments to avoid analysis. This package contains no real functional code and is intended solely for credential theft. The campaign is linked to a known actor previously using the @emcd-vue scope.

If installed, this package compromises the confidentiality of a wide range of sensitive credentials and configuration files on the host system. This can lead to unauthorized access to cloud services, source code repositories, container registries, and other critical infrastructure. The exfiltration methods are designed to evade network detection, increasing the risk of stealthy data theft. The presence of environment fingerprinting and anti-debugging measures indicates a sophisticated threat actor aiming to maintain persistence and avoid analysis.

Avoid installing the @marketfront/digitalherobannercarousel package version 7.0.0 or any other packages from the @marketfront scope published on 2026-07-01. Remove any installations of this package immediately. Since no official patch or remediation is available, rely on blocking or auditing dependencies from untrusted or unknown scopes. Use strict package source verification and supply chain security practices to prevent dependency confusion attacks. Monitor for suspicious postinstall scripts in npm packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.