Malicious code in @marketfront/dynamicpageparams (npm)
The @marketfront/dynamicpageparams package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' ([email protected]) within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use e-commerce/marketing frontend component names as cover. The package declares a postinstall hook (node scripts/postinstall.js) that executes heavily obfuscated (obfuscator.io-style) code automatically at npm install time. Static analysis of the decoded payload revealed a credential harvester that dynamically requires fs, os, http, https, zlib, path and dns, then reads approximately 20 sensitive credential files including ~/.ssh, ~/.aws/credentials, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.netrc, ~/.pgpass, ~/.git-credentials, ~/.env and ~/.bash_history. Collected data is exfiltrated via a gzip-compressed HTTPS POST with a custom X-Secret header to the path /api/v1/events, alongside a DNS resolver beacon. The command-and-control host is concealed behind an additional RC4+XOR encryption layer around an embedded configuration blob and was not statically resolved. The decoded behavioral payload (module requires, credential-file target list, exfiltration headers and endpoint) is byte-for-byte identical across sampled packages in the campaign. The campaign shares tooling and infrastructure patterns (obfuscated postinstall credential harvester, X-Secret header, /api/v1/events exfiltration path, RC4-concealed C2) with the earlier @emcd-vue campaign, indicating the same actor rotating scopes and disposable maintainer emails. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (514b19e5c1b1245c9c2a18b89858e78e48cde1170365d2e033d128491234e36b) Automated tracing of this package's contents was withheld by an upstream content filter, and no a static rule findings are available to corroborate a specific attack fingerprint. The content-filter signal is suggestive but, on its own without concrete traced or static evidence naming a specific installer-harm behavior (exfiltration destination, credential path read, install-time fetch-and-execute, backdoor), it does not meet the bar for a published block verdict. The package should be manually inspected before use: review package.json lifecycle scripts (preinstall/install/postinstall/prepare), the module's top-level require/import side effects, and any bundled or minified JavaScript for hardcoded network destinations, credential-path reads (~/.npmrc, ~/.aws, ~/.ssh, environment scraping), or remote fetch-and-execute patterns.
AI Analysis
Technical Summary
The @marketfront/dynamicpageparams package (version 7.0.0) was published as part of a coordinated malicious campaign on 2026-07-01. It includes a postinstall lifecycle hook that runs heavily obfuscated code designed to harvest sensitive credential files such as SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm credentials, and environment histories from the user's home directory. The harvested data is compressed and exfiltrated over HTTPS with a custom X-Secret header to a hidden API endpoint, alongside DNS beaconing. The command-and-control infrastructure is concealed using RC4 and XOR encryption. The malicious payload is identical across the campaign's packages and shares characteristics with a previous campaign under a different npm scope, suggesting the same threat actor. No automated block verdict was issued due to lack of direct runtime evidence, so manual inspection is recommended before use.
Potential Impact
If installed, the package executes a postinstall script that can steal a wide range of sensitive credentials from the user's environment, including SSH keys, cloud service credentials, container registry tokens, and local environment variables. This can lead to credential compromise, unauthorized access to cloud and development resources, and further compromise of the victim's infrastructure. The exfiltration is covert, using encrypted communication channels and DNS beaconing, making detection difficult without proactive monitoring.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should avoid installing @marketfront/dynamicpageparams version 7.0.0 and any other packages from the @marketfront scope published in the same campaign window. Manual inspection of package lifecycle scripts and bundled code is recommended before installation. Consider using trusted package sources and verifying package integrity. If the package has been installed, investigate potential credential exposure and rotate affected credentials immediately.
Malicious code in @marketfront/dynamicpageparams (npm)
Description
The @marketfront/dynamicpageparams package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' ([email protected]) within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use e-commerce/marketing frontend component names as cover. The package declares a postinstall hook (node scripts/postinstall.js) that executes heavily obfuscated (obfuscator.io-style) code automatically at npm install time. Static analysis of the decoded payload revealed a credential harvester that dynamically requires fs, os, http, https, zlib, path and dns, then reads approximately 20 sensitive credential files including ~/.ssh, ~/.aws/credentials, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.netrc, ~/.pgpass, ~/.git-credentials, ~/.env and ~/.bash_history. Collected data is exfiltrated via a gzip-compressed HTTPS POST with a custom X-Secret header to the path /api/v1/events, alongside a DNS resolver beacon. The command-and-control host is concealed behind an additional RC4+XOR encryption layer around an embedded configuration blob and was not statically resolved. The decoded behavioral payload (module requires, credential-file target list, exfiltration headers and endpoint) is byte-for-byte identical across sampled packages in the campaign. The campaign shares tooling and infrastructure patterns (obfuscated postinstall credential harvester, X-Secret header, /api/v1/events exfiltration path, RC4-concealed C2) with the earlier @emcd-vue campaign, indicating the same actor rotating scopes and disposable maintainer emails. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (514b19e5c1b1245c9c2a18b89858e78e48cde1170365d2e033d128491234e36b) Automated tracing of this package's contents was withheld by an upstream content filter, and no a static rule findings are available to corroborate a specific attack fingerprint. The content-filter signal is suggestive but, on its own without concrete traced or static evidence naming a specific installer-harm behavior (exfiltration destination, credential path read, install-time fetch-and-execute, backdoor), it does not meet the bar for a published block verdict. The package should be manually inspected before use: review package.json lifecycle scripts (preinstall/install/postinstall/prepare), the module's top-level require/import side effects, and any bundled or minified JavaScript for hardcoded network destinations, credential-path reads (~/.npmrc, ~/.aws, ~/.ssh, environment scraping), or remote fetch-and-execute patterns.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @marketfront/dynamicpageparams package (version 7.0.0) was published as part of a coordinated malicious campaign on 2026-07-01. It includes a postinstall lifecycle hook that runs heavily obfuscated code designed to harvest sensitive credential files such as SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm credentials, and environment histories from the user's home directory. The harvested data is compressed and exfiltrated over HTTPS with a custom X-Secret header to a hidden API endpoint, alongside DNS beaconing. The command-and-control infrastructure is concealed using RC4 and XOR encryption. The malicious payload is identical across the campaign's packages and shares characteristics with a previous campaign under a different npm scope, suggesting the same threat actor. No automated block verdict was issued due to lack of direct runtime evidence, so manual inspection is recommended before use.
Potential Impact
If installed, the package executes a postinstall script that can steal a wide range of sensitive credentials from the user's environment, including SSH keys, cloud service credentials, container registry tokens, and local environment variables. This can lead to credential compromise, unauthorized access to cloud and development resources, and further compromise of the victim's infrastructure. The exfiltration is covert, using encrypted communication channels and DNS beaconing, making detection difficult without proactive monitoring.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should avoid installing @marketfront/dynamicpageparams version 7.0.0 and any other packages from the @marketfront scope published in the same campaign window. Manual inspection of package lifecycle scripts and bundled code is recommended before installation. Consider using trusted package sources and verifying package integrity. If the package has been installed, investigate potential credential exposure and rotate affected credentials immediately.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6776
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50ba5c68715ace4357eff6
Added to database: 07/10/2026, 09:24:44 UTC
Last enriched: 07/10/2026, 09:45:33 UTC
Last updated: 07/29/2026, 00:48:37 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.