The @marketfront/digitalherobannercarousel npm package version 7.0.0 is part of a malicious campaign involving 25 packages published under the @marketfront scope. It contains a heavily obfuscated postinstall script that executes automatically during npm install, harvesting sensitive credential files from the user's environment and exfiltrating them via encrypted HTTPS POST requests and DNS queries to a concealed command-and-control server. The package has no legitimate library functionality and is designed as a dependency-confusion lure. The campaign shares infrastructure and tactics with a previous malicious campaign, indicating a persistent threat actor.