MAL-2026-6772

The @marketfront/customdealsfeed package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' (marketfront@tutamail.com) within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use e-commerce/marketing frontend component names as cover.

The package declares a postinstall hook (node scripts/postinstall.js) that executes heavily obfuscated (obfuscator.io-style) code automatically at npm install time. Static analysis of the decoded payload revealed a credential harvester that dynamically requires fs, os, http, https, zlib, path and dns, then reads approximately 20 sensitive credential files including ~/.ssh, ~/.aws/credentials, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.netrc, ~/.pgpass, ~/.git-credentials, ~/.env and ~/.bash_history. Collected data is exfiltrated via a gzip-compressed HTTPS POST with a custom X-Secret header to the path /api/v1/events, alongside a DNS resolver beacon. The command-and-control host is concealed behind an additional RC4+XOR encryption layer around an embedded configuration blob and was not statically resolved.

The decoded behavioral payload (module requires, credential-file target list, exfiltration headers and endpoint) is byte-for-byte identical across sampled packages in the campaign. The campaign shares tooling and infrastructure patterns (obfuscated postinstall credential harvester, X-Secret header, /api/v1/events exfiltration path, RC4-concealed C2) with the earlier @emcd-vue campaign, indicating the same actor rotating scopes and disposable maintainer emails.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dcdb247433e08e6bcd6ad2d50beedf663648e089d745d4608959d0e42efac2af)

The package has no legitimate runtime surface: package.json 'main' re-exports../src/index.js which is not shipped in the tarball, so require() throws. The only executed code is scripts/postinstall.js, a ~165KB obfuscator.io-style payload that runs automatically on npm install. It uses a string-array decoder plus RC4 and XOR routines to hide its behavior, and contains a sandbox-evasion guard that suppresses execution when NODEOPTIONS or the package name match hardcoded analysis-environment values. At install time the decoded payload collects host and account identity (os.userInfo, hostname, platform, arch, network interfaces), enumerates environment variables (including USERDOMAIN, COMPUTERNAME, APPDATA, LOCALAPPDATA, TEMP, PROGRAMDATA, npmconfiguseragent and a full process.env dump), executes shell commands via child_process, and reads candidate credential/wallet/keystore files under APPDATA/LOCALAPPDATA/TEMP/PROGRAMDATA using a JSON key/value walker. The collected data is bundled into an encrypted JSON blob and transmitted over HTTPS to a hardcoded endpoint, with a DNS side-channel that splits ciphertext into ~50-character chunks encoded as sub.sub.HOST queries to bypass egress filtering. The @marketfront scope and README instruction to add 'registry=https://npm.marketfront.io' to.npmrc — pointing at non-existent infrastructure — is a dependency-confusion lure targeting organizations that have not correctly pinned an internal scope, with a fake 'anonymous telemetry to telemetry.marketfront.io' cover story pre-authorizing the observed network activity.