The @marketfront/madvpopup npm package version 7.0.0 is part of a malicious campaign involving 25 packages published within a short time frame. It contains a heavily obfuscated postinstall script that executes automatically during npm install, harvesting sensitive credential files and environment variables from the host system. The stolen data is exfiltrated via encrypted HTTPS requests to a concealed command-and-control server. The package masquerades as a legitimate e-commerce frontend component and uses an internal-corporate namespace style to facilitate dependency confusion attacks against targeted organizations.