The @marketfront/livestreampreviewpopup package (version 7.0.0) is a malicious npm package published as part of a batch campaign under the @marketfront scope. It includes a heavily obfuscated postinstall hook that runs automatically on installation, harvesting approximately 20 sensitive credential files such as SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm credentials, and shell histories. The harvested data is encrypted with RC4 and exfiltrated via HTTPS POST requests to a dynamically reconstructed endpoint and via DNS resolver beacons to bypass egress filtering. The package masquerades as an internal platform engineering component with fake repository URLs and instructs users to configure a private registry, consistent with a dependency confusion attack. The package's main entry point is broken, causing immediate errors, confirming it is not intended for legitimate use but solely for credential harvesting. This campaign shares infrastructure and tooling with a previous malicious campaign, indicating the same threat actor. No patch or fix is currently documented.

Successful installation of this package results in the compromise of sensitive credentials and environment information from the host system. This includes SSH keys, cloud service credentials, Kubernetes configuration, Docker credentials, npm credentials, and shell history, which can lead to further unauthorized access and potential lateral movement within compromised environments. The data exfiltration uses encrypted channels and DNS side-channels to evade detection and network filtering. The package also disrupts normal usage by causing errors when required, indicating it is not intended for legitimate functionality but for malicious data theft.

No official patch or remediation is currently available for this malicious package. The best mitigation is to avoid installing the @marketfront/livestreampreviewpopup package version 7.0.0 and any other packages from the identified malicious campaign. Organizations should audit their dependency sources and private npm scopes to prevent dependency confusion attacks. Verify package authenticity before installation, especially for internal or private scope packages. Monitor for and remove any instances of this package if found in your environment. Since this is a malicious package rather than a vulnerability in legitimate software, remediation focuses on prevention and detection rather than patching.