Threats Tagged 'mal-2026-6774'

The @marketfront/devtoolsloader npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time frame. It contains a heavily obfuscated postinstall script that executes automatically during npm install, harvesting sensitive credentials and environment data from developer machines. The harvested data includes SSH keys, AWS credentials, Kubernetes configs, Docker configs, npm and git credentials, shell history, and environment variables. This data is exfiltrated via encrypted HTTPS POST requests and DNS queries to attacker-controlled infrastructure. The package contains no legitimate functionality and is designed to lure developers expecting internal corporate packages. The campaign shares infrastructure and tactics with a previous malicious campaign, indicating a recurring threat actor. No CVSS score is assigned, but the impact is severe due to credential theft and potential compromise of developer environments.