The @marketfront/header package (version 7.0.0) was published as part of a 25-package malicious campaign under the @marketfront npm scope by the user 'marketfront'. The package declares a postinstall hook executing an obfuscated ~160KB script that runs at install time. This script dynamically loads Node.js modules (fs, os, http, https, zlib, path, dns) to read approximately 20 sensitive credential files from the user's home directory, including SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm and git credentials, environment files, and shell history. It collects environment variables and system identifiers, compresses the data, and exfiltrates it over HTTPS with a custom X-Secret header to a hidden endpoint (/api/v1/events). The command-and-control configuration is concealed with RC4+XOR encryption. The payload is identical across the campaign packages and shares infrastructure and techniques with a prior campaign (@emcd-vue), suggesting the same threat actor rotating scopes and maintainer identities. This behavior constitutes a supply-chain install-time credential stealer with no legitimate purpose.

Installation of the affected package version 7.0.0 results in automatic execution of malicious code that harvests a broad range of sensitive credential files and environment data from the installer's system. This data is exfiltrated to a remote attacker-controlled server, potentially compromising user credentials, cloud service keys, container and Kubernetes configurations, and other sensitive secrets. This can lead to unauthorized access to user accounts, cloud resources, source code repositories, and other sensitive infrastructure. The attack occurs at install time, making it a supply-chain threat that can affect developers and automated build environments.

No official patch or remediation is currently available for this malicious package version. Users and organizations should avoid installing @marketfront/header version 7.0.0 and any other packages from the @marketfront scope published on or around 2026-07-01. Remove any installations of these packages and rotate any potentially compromised credentials that may have been exposed. Monitor for suspicious network traffic related to the described exfiltration patterns. Since this is a supply-chain threat, verify package provenance and prefer trusted sources. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.