The @marketfront/gotoauthpopup npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time frame. It contains a heavily obfuscated postinstall script that executes automatically on npm install, harvesting a wide range of sensitive credential and configuration files from the host system. The stolen data is exfiltrated via encrypted HTTPS POST requests and covert DNS tunneling to a concealed command-and-control server. The package impersonates internal corporate infrastructure to deceive developers and has no legitimate functionality. This campaign shares infrastructure and tactics with a previous malicious npm campaign, indicating a recurring threat actor.