The @marketfront/navbar package (version 7.0.0) is a malicious npm package published as part of a 25-package campaign under the @marketfront scope by a user 'marketfront'. It includes a postinstall hook script that executes automatically on npm install, running heavily obfuscated code that collects extensive system and credential information from the host environment, including SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm and git credentials, environment variables, and shell history. The stolen data is compressed, encrypted, and exfiltrated over HTTPS POST requests and DNS TXT tunnels to a concealed command-and-control server. The payload includes anti-analysis checks to evade detection in CI and developer environments. The package contains no usable library code, serving solely as a credential stealer. This campaign shares infrastructure and tactics with a previous malicious campaign, indicating a persistent threat actor.

Installation of this package results in the compromise of sensitive credentials and environment data from the host system. This includes cloud provider tokens, npm publish tokens, registry credentials, and CI secrets commonly present in developer and continuous integration environments. The attacker gains access to these credentials, potentially leading to unauthorized access to cloud infrastructure, source code repositories, and other critical resources associated with the compromised accounts.

No official patch or remediation is available as this is a malicious package published to the npm registry. Users should avoid installing @marketfront/navbar version 7.0.0 and any other packages from the @marketfront scope published around 2026-07-01. Audit and remove any such packages if installed. Rotate any potentially exposed credentials and secrets from affected environments. Employ strict package source verification and use tools to detect malicious postinstall scripts in dependencies.