The @marketfront/designsystemdevtool npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short timeframe. It contains an obfuscated postinstall script that executes automatically during npm install, harvesting sensitive credentials and environment data from the host system. The stolen data includes SSH keys, cloud credentials, Docker and Kubernetes configs, npm and git credentials, environment variables, and shell history. This data is exfiltrated via HTTPS POST requests with additional DNS tunneling fallback to attacker-controlled infrastructure. The package impersonates an internal Marketfront scope but lacks legitimate functionality, serving solely as a credential stealer. The campaign shares infrastructure and techniques with a prior malicious campaign, indicating a persistent threat actor. No official patch or remediation is currently documented.