The @marketfront/livestreampreviewpopup npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time frame. It contains an obfuscated postinstall script that executes automatically during npm install, harvesting sensitive credential files from the user's home directory and environment. The stolen data is exfiltrated via encrypted HTTPS POST requests and DNS-based side channels to a concealed command-and-control server. The package is designed to appear as an internal platform engineering component for the @marketfront scope, likely targeting organizations using private scoped registries. The package's main module is non-functional, causing immediate errors if required, indicating its sole purpose is credential theft. No prior versions exist, and no official patch or remediation is currently available.