Threats Tagged 'mal-2026-6778'

The @marketfront/fashiononboardingpopup npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time frame. It contains a postinstall script that executes automatically during npm install, running heavily obfuscated code that harvests sensitive credential files from the host system. The stolen data is compressed and exfiltrated via HTTPS POST requests to a concealed command-and-control server. The package's functional code is a stub, designed to appear as an internal private package to evade suspicion. The campaign shares characteristics with a previous malicious campaign, indicating a recurring threat actor.