The @marketfront/infopopup npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time frame. It contains a postinstall script that executes heavily obfuscated code to harvest sensitive credential files and environment data from the installer’s system. The stolen data is exfiltrated via encrypted HTTPS POST requests and DNS tunneling to attacker-controlled infrastructure. The package masquerades as an internal authentication client but performs unauthorized credential harvesting and data exfiltration.