MalwarePublished 2 Jul 2026Updated 6 Jul 2026

@marketfront/livestreampreviewpopup (npm) · Malicious Code

Affects @marketfront/livestreampreviewpopupSource GCVE Database

Malicious package : remove @marketfront/livestreampreviewpopup and rotate any secrets on hosts that installed it.

Data as of 6 Jul 2026, 23:22 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6784

What to do

Remove @marketfront/livestreampreviewpopup from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@marketfront/livestreampreviewpopup	Affected =7.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @marketfront/livestreampreviewpopup npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time frame. It contains an obfuscated postinstall script that executes automatically during npm install, harvesting sensitive credential files from the user's home directory and environment. The stolen data is exfiltrated via encrypted HTTPS POST requests and DNS-based side channels to a concealed command-and-control server. The package is designed to appear as an internal platform engineering component for the @marketfront scope, likely targeting organizations using private scoped registries. The package's main module is non-functional, causing immediate errors if required, indicating its sole purpose is credential theft. No prior versions exist, and no official patch or remediation is currently available.

Impact

Successful installation of this package results in the compromise of sensitive credentials and environment information from the host system. This includes SSH keys, cloud service credentials, Kubernetes configuration, Docker credentials, npm credentials, and shell history, which can lead to further unauthorized access and potential lateral movement within compromised environments. The data exfiltration uses encrypted channels and DNS side-channels to evade detection and network filtering. The package also disrupts normal usage by causing errors when required, indicating it is not intended for legitimate functionality but for malicious data theft.

Defensive guidance

The best mitigation is to avoid installing the @marketfront/livestreampreviewpopup package version 7.0.0 and any other packages from the identified malicious campaign. Organizations should audit their dependency sources and private npm scopes to prevent dependency confusion attacks. Verify package authenticity before installation, especially for internal or private scope packages. Monitor for and remove any instances of this package if found in your environment. Since this is a malicious package rather than a vulnerability in legitimate software, remediation focuses on prevention and detection rather than patching.

Summary

The @marketfront/livestreampreviewpopup package (version 7.0.0) is a malicious npm package published as part of a batch campaign under the @marketfront scope. It includes a heavily obfuscated postinstall hook that runs automatically on installation, harvesting approximately 20 sensitive credential files such as SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm credentials, and shell histories. The harvested data is encrypted with RC4 and exfiltrated via HTTPS POST requests to a dynamically reconstructed endpoint and via DNS resolver beacons to bypass egress filtering. The package masquerades as an internal platform engineering component with fake repository URLs and instructs users to configure a private registry, consistent with a dependency confusion attack. The package's main entry point is broken, causing immediate errors, confirming it is not intended for legitimate use but solely for credential harvesting. This campaign shares infrastructure and tooling with a previous malicious campaign, indicating the same threat actor.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Jul 2026, 23:22 UTC

Technical details

References

Community reviews