The @marketfront/mychatspreloader package (version 7.0.0) is a malicious npm package published as part of a 25-package campaign under the @marketfront scope. It includes a heavily obfuscated postinstall.js script that runs automatically on npm install. This script enumerates environment variables, collects OS and user information, and reads approximately 20 sensitive credential files from common locations on Unix-like and Windows systems. The harvested data is exfiltrated via a gzip-compressed HTTPS POST request with a custom X-Secret header and via DNS resolver beaconing, using an RC4+XOR encrypted embedded configuration to conceal the command-and-control host. The package has no legitimate code or functionality and is intended solely for credential theft. The campaign reuses tooling and infrastructure from a previous @emcd-vue campaign, suggesting the same threat actor rotating npm scopes and maintainer identities.

Successful installation of this package results in the theft of a wide range of sensitive credentials and configuration files from the victim's system, including SSH keys, cloud service credentials, Kubernetes configs, Docker credentials, npm tokens, Git credentials, environment variables, and shell history. This can lead to unauthorized access to source code repositories, cloud environments, container registries, and other critical infrastructure. The exfiltration methods include encrypted HTTPS POST requests and DNS tunneling, making detection and blocking more difficult. The package itself provides no legitimate functionality, so its presence indicates compromise.

No official patch or remediation is available since this is a malicious package rather than a vulnerability in legitimate software. The package should be removed and blocked from use. Users and organizations should audit their npm dependencies for any @marketfront scoped packages, especially version 7.0.0 of mychatspreloader, and remove them immediately. Avoid installing packages from untrusted or unexpected scopes, especially those purporting to be internal registries without verification. Monitor for signs of credential compromise and rotate any potentially exposed credentials. Since this is not a cloud service, remediation depends on user action. Patch status is not applicable; check vendor or registry advisories for updates.