Threats Tagged 'mal-2026-6771'

The @marketfront/commonecommerce npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time frame. It contains a heavily obfuscated postinstall script that executes automatically during npm install, harvesting sensitive credentials and environment data from the host. The stolen data includes SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm and git credentials, environment files, and shell history. Exfiltration occurs via encrypted HTTPS POST requests and covert DNS tunneling to a concealed command-and-control server. The package masquerades as a legitimate telemetry client for a non-existent organization, with a non-functional advertised API. No patch or remediation is currently documented.