{"id":"MAL-2026-6768","summary":"Malicious code in @marketfront/blenderdevtool (npm)","details":"The @marketfront/blenderdevtool package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' (marketfront@tutamail.com) within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use e-commerce/marketing frontend component names as cover.\n\nThe package declares a postinstall hook (node scripts/postinstall.js) that executes heavily obfuscated (obfuscator.io-style) code automatically at npm install time. Static analysis of the decoded payload revealed a credential harvester that dynamically requires fs, os, http, https, zlib, path and dns, then reads approximately 20 sensitive credential files including ~/.ssh, ~/.aws/credentials, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.netrc, ~/.pgpass, ~/.git-credentials, ~/.env and ~/.bash_history. Collected data is exfiltrated via a gzip-compressed HTTPS POST with a custom X-Secret header to the path /api/v1/events, alongside a DNS resolver beacon. The command-and-control host is concealed behind an additional RC4+XOR encryption layer around an embedded configuration blob and was not statically resolved.\n\nThe decoded behavioral payload (module requires, credential-file target list, exfiltration headers and endpoint) is byte-for-byte identical across sampled packages in the campaign. The campaign shares tooling and infrastructure patterns (obfuscated postinstall credential harvester, X-Secret header, /api/v1/events exfiltration path, RC4-concealed C2) with the earlier @emcd-vue campaign, indicating the same actor rotating scopes and disposable maintainer emails.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cbaf34bd1bf73af787679197a51e9147f20a2f1ade5576e4b8ca9d9a36cf7363)\nOn `npm install`, scripts/postinstall.js executes an obfuscator.io-style bundle (212-entry RC4-decoded rotated string array, integer opaque predicates, char-code array constructors) that reads installer-owned secret files including ~/.npmrc, ~/.aws/credentials, ~/.ssh/*, ~/.docker/config.json and.env, bulk-scrapes process.env, and collects host identifiers (os.hostname, os.userInfo, network interfaces). The collected payload is XOR-encrypted with a key derived from the package identity, chunked into a 33-character alphabet, and exfiltrated as recursive DNS queries via dns.Resolver().resolve to a hardcoded external host — a channel chosen to bypass HTTP egress filtering and proxy allowlists. The install path is gated by an anti-analysis check that scans process.argv and NODE_OPTIONS for instrumentation fingerprints and runs a CPU-timing loop to detect VMs/debuggers, so sandboxed installs appear inert. The package additionally exhibits a dependency-confusion shape: it uses the @marketfront/* scope, its README labels it an 'Internal package — Platform Engineering Team', and its metadata (homepage/repository/bugs) points at *.marketfront.io hosts, indicating the public-registry publish is intended to be resolved in place of an internal package of the same name by a target organization's build pipeline. The README claim of 'anonymous telemetry' is a cover story that does not match the observed behavior.\n","modified":"2026-07-06T05:16:47.472332904Z","published":"2026-07-02T00:00:00Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-07-06T04:58:10.370452185Z","sha256":"cbaf34bd1bf73af787679197a51e9147f20a2f1ade5576e4b8ca9d9a36cf7363","modified_time":"2026-07-06T03:19:18Z","id":"IN-MAL-2026-008019","source":"amazon-inspector","versions":["7.0.0"]}]},"references":[{"type":"REPORT","url":"https://safedep.io/marketfront-dependency-confusion-campaign/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@marketfront/blenderdevtool/v/7.0.0"}],"affected":[{"package":{"name":"@marketfront/blenderdevtool","ecosystem":"npm","purl":"pkg:npm/%40marketfront%2Fblenderdevtool"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["7.0.0"],"database_specific":{"indicators":{"package_integrity":[{"filename":"blenderdevtool-7.0.0.tgz","hashes":{"sha512_sri":"sha512-yIZs4frF61BfWEW0qU5wIcYfbZsYQ8vnDJPATgVP1HpM+p+Zl25hmT32N8KLRs6vJKFz7a3s2mvRpao4hTKhPg==","sha1":"c4c65852a56d23bec2a2cff1478533c1abf83c5c"}}],"evidence_files":[{"tlsh":"00f3da892740d457d85fdfbf7e61e6f4e11a7cc6c3c1284af714b83ce89852a9a48b81","sha256":"97d72c966d647592649ea998de85ee2290c7abd9f7fc5d1ed2ecd74e8a3b5d49","path":"scripts/postinstall.js"},{"tlsh":"ab118c31c5299d2362c51596fdb41d42b97b195f098dfc0da2c3502c0bcd1a690fd73d","sha256":"384a88f8b4e74fc8eccb16f51adf3eb4baf10f6e6771696e33d0ed16f2b89f12","path":"package.json"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@marketfront/blenderdevtool/MAL-2026-6768.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}