The @marketfront/errorcounter package (version 7.0.0) is a malicious npm package published as part of a 25-package campaign under the @marketfront scope. It contains an obfuscated postinstall hook that runs automatically on npm install, executing a credential harvester that reads approximately 20 sensitive credential files (e.g., ~/.ssh, ~/.aws/credentials, ~/.kube/config) and environment variables. The harvested data is compressed and exfiltrated via HTTPS POST requests with a custom header and fallback DNS tunneling to a command-and-control server concealed by additional encryption. The package is non-functional as a library and uses anti-sandboxing techniques including timing loops and environment checks to evade detection. This campaign shares tooling and infrastructure with a prior malicious campaign, indicating the same threat actor. The attack targets build systems that mistakenly resolve the internal @marketfront scope to the public npm registry, causing automatic execution of the stealer and exposure of CI secrets and environment variables.

Successful installation of this package leads to automatic execution of a credential harvesting payload that collects sensitive files and environment variables from the host system. This includes SSH keys, cloud credentials, Kubernetes configs, Docker credentials, npm tokens, Git credentials, and shell histories. The stolen data is exfiltrated to a remote attacker-controlled server, potentially compromising developer and CI environment secrets. The package is non-functional for legitimate use and serves solely as a supply-chain malware vector. Any build or deployment system that resolves the @marketfront scope to this malicious package risks exposure of internal secrets and credentials, leading to potential further compromise of infrastructure and services.

No official patch or fix is available as this is a malicious package published to the public npm registry. The primary mitigation is to ensure that internal npm scopes like @marketfront are correctly resolved to private registries and not to the public npm repository. Audit and restrict package sources in build systems to prevent dependency confusion attacks. Remove and block installation of version 7.0.0 of @marketfront/errorcounter and related malicious packages from this campaign. Monitor for and revoke any potentially exposed credentials and secrets. Use tools to detect and block packages with postinstall scripts that execute obfuscated or suspicious code. Review CI/CD pipeline configurations to prevent automatic execution of untrusted packages.