The @marketfront/basemarkettemplate npm package version 7.0.0 is part of a malicious campaign involving 25 packages published under the @marketfront scope. It contains an obfuscated postinstall script that executes automatically during npm install, harvesting sensitive credential files from the host and exfiltrating them via encrypted HTTPS and DNS channels. The package masquerades as an internal HTTP client with fake corporate URLs but provides no legitimate functionality. This campaign shares infrastructure and tooling with a previous malicious campaign, indicating a recurring threat actor.