The @marketfront/header npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short timeframe. It contains a heavily obfuscated postinstall script that executes automatically during npm install. This script harvests sensitive credential files and environment data from the installer's system and exfiltrates the data via encrypted HTTPS POST requests to a concealed command-and-control server. The campaign shares tooling and infrastructure with a previous malicious campaign, indicating a recurring threat actor.