Threats Tagged 'mal-2026-6766'

The @marketfront/baobabtech npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time frame. It contains a heavily obfuscated postinstall script that executes automatically during npm install. This script harvests sensitive credentials and environment information from the host, including SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm and git credentials, and various environment variables. The stolen data is exfiltrated via a compressed HTTPS POST request to a concealed command-and-control server. The campaign shares infrastructure and techniques with a prior malicious campaign, indicating a recurring threat actor. This package falsely advertises itself as a database utility but performs unauthorized credential theft at install time.