MalwarePublished 2 Jul 2026Updated 6 Jul 2026

@marketfront/navbar (npm) · Malicious Code

Affects @marketfront/navbarSource GCVE Database

Malicious package : remove @marketfront/navbar and rotate any secrets on hosts that installed it.

Data as of 6 Jul 2026, 23:39 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6787

What to do

Remove @marketfront/navbar from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@marketfront/navbar	Affected =7.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @marketfront/navbar npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short timeframe. It contains a heavily obfuscated postinstall script that harvests sensitive credentials from the installing environment and exfiltrates them via encrypted HTTPS and DNS channels. The package masquerades as a legitimate internal logger but lacks functional library code. The attack targets developer and CI environments, risking compromise of cloud tokens, npm credentials, and other secrets.

Impact

Installation of this package results in the compromise of sensitive credentials and environment data from the host system. This includes cloud provider tokens, npm publish tokens, registry credentials, and CI secrets commonly present in developer and continuous integration environments. The attacker gains access to these credentials, potentially leading to unauthorized access to cloud infrastructure, source code repositories, and other critical resources associated with the compromised accounts.

Defensive guidance

Users should avoid installing @marketfront/navbar version 7.0.0 and any other packages from the @marketfront scope published around 2026-07-01. Audit and remove any such packages if installed. Rotate any potentially exposed credentials and secrets from affected environments. Employ strict package source verification and use tools to detect malicious postinstall scripts in dependencies.

Summary

The @marketfront/navbar package (version 7.0.0) is a malicious npm package published as part of a 25-package campaign under the @marketfront scope by a user 'marketfront'. It includes a postinstall hook script that executes automatically on npm install, running heavily obfuscated code that collects extensive system and credential information from the host environment, including SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm and git credentials, environment variables, and shell history. The stolen data is compressed, encrypted, and exfiltrated over HTTPS POST requests and DNS TXT tunnels to a concealed command-and-control server. The payload includes anti-analysis checks to evade detection in CI and developer environments. The package contains no usable library code, serving solely as a credential stealer. This campaign shares infrastructure and tactics with a previous malicious campaign, indicating a persistent threat actor.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Jul 2026, 23:39 UTC

Technical details

References

Community reviews