The @marketfront/footer package (version 7.0.0) was published as part of a coordinated malicious campaign on 2026-07-01. It includes a postinstall hook executing obfuscated code that collects a wide range of sensitive credential files and environment variables from the host system. The harvested data is compressed, encoded, and exfiltrated using DNS TXT queries and HTTPS POST requests with custom headers to evade detection and bypass network egress filtering. The campaign shares infrastructure and techniques with a previous malicious campaign (@emcd-vue), indicating the same threat actor. The package itself contains no functional code, serving only as a vehicle for the credential harvester and uses an internal-name impersonation strategy to facilitate dependency confusion attacks.

Systems that install the @marketfront/footer package version 7.0.0 are at risk of having sensitive credentials and environment secrets stolen. This includes SSH keys, AWS credentials, Docker and npm configuration files, Git credentials, and various environment variables that may contain tokens and passwords. The exfiltration methods are designed to evade common network filtering, increasing the likelihood of successful data theft. This can lead to unauthorized access to cloud services, source code repositories, databases, and other critical infrastructure.

No official patch or remediation is currently available. Users and organizations should immediately audit their dependencies and remove any packages from the @marketfront scope, especially version 7.0.0 of @marketfront/footer. Avoid installing packages from untrusted or suspicious npm scopes. Monitor for any signs of credential compromise and rotate any potentially exposed secrets. Since this is a malicious package, the best mitigation is to prevent installation and remove it if already present.