Threats Tagged 'mal-2026-6772'

The @marketfront/customdealsfeed npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time window. It contains a heavily obfuscated postinstall script that executes automatically during npm install, harvesting sensitive credential files from the host and exfiltrating them via encrypted HTTPS requests and DNS beacons. The package has no legitimate runtime code and uses sandbox evasion techniques to avoid detection. This campaign reuses tooling and infrastructure from a previous malicious campaign, indicating a persistent threat actor. The package also attempts dependency confusion by instructing users to add a fake registry URL in .npmrc, potentially targeting organizations with misconfigured internal scopes.