Threats Tagged 'mal-2026-6777'

The @marketfront/errorcounter npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time frame. It contains a heavily obfuscated postinstall script that executes automatically during npm install, harvesting sensitive credential files and environment information from the host. The stolen data is exfiltrated via encrypted HTTPS POST requests and DNS beaconing to a concealed command-and-control server. The package itself is non-functional as advertised and serves solely as a supply-chain malware lure targeting internal @marketfront npm scopes. The campaign uses anti-analysis techniques to evade sandbox detection and shares infrastructure with a previous malicious campaign, indicating a persistent threat actor. Any build system that mistakenly resolves the @marketfront scope to public npm risks automatic credential theft during CI builds.