Threats Tagged 'mal-2026-6768'

The @marketfront/blenderdevtool npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within minutes under the @marketfront scope. It contains an obfuscated postinstall script that harvests sensitive credential files and environment data from the host system and exfiltrates this information via encrypted HTTPS POST requests and DNS queries to a concealed command-and-control server. The package uses anti-analysis techniques to evade detection in sandboxed or instrumented environments. The campaign mimics legitimate internal packages to exploit dependency confusion in targeted organizations' build pipelines. No official patch or remediation guidance is currently available.