{"id":"MAL-2026-6777","summary":"Malicious code in @marketfront/errorcounter (npm)","details":"The @marketfront/errorcounter package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' (marketfront@tutamail.com) within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use e-commerce/marketing frontend component names as cover.\n\nThe package declares a postinstall hook (node scripts/postinstall.js) that executes heavily obfuscated (obfuscator.io-style) code automatically at npm install time. Static analysis of the decoded payload revealed a credential harvester that dynamically requires fs, os, http, https, zlib, path and dns, then reads approximately 20 sensitive credential files including ~/.ssh, ~/.aws/credentials, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.netrc, ~/.pgpass, ~/.git-credentials, ~/.env and ~/.bash_history. Collected data is exfiltrated via a gzip-compressed HTTPS POST with a custom X-Secret header to the path /api/v1/events, alongside a DNS resolver beacon. The command-and-control host is concealed behind an additional RC4+XOR encryption layer around an embedded configuration blob and was not statically resolved.\n\nThe decoded behavioral payload (module requires, credential-file target list, exfiltration headers and endpoint) is byte-for-byte identical across sampled packages in the campaign. The campaign shares tooling and infrastructure patterns (obfuscated postinstall credential harvester, X-Secret header, /api/v1/events exfiltration path, RC4-concealed C2) with the earlier @emcd-vue campaign, indicating the same actor rotating scopes and disposable maintainer emails.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d15a354db253fd90616eb7e33d8c09dd7dd36b691259ec737182a96f9b5d65ab)\nThis package is a dependency-confusion lure targeting an internal `@marketfront` npm scope. The declared library entry point (`dist/index.js`) re-exports `../src/index.js`, which is not shipped — the package is non-functional as advertised. Its only real behavior is the declared `postinstall` hook (`node scripts/postinstall.js`), which is a heavily obfuscated (obfuscator.io-style string-array RC4 decoder, control-flow dead-code, function/property indirection) payload that runs automatically on `npm install`. At install time it collects `os.hostname`, `os.type`, `os.release`, `os.arch`, `os.version`, `os.homedir`, `os.userInfo().username`, `os.networkInterfaces`, the full `process.env`, and Windows-specific env vars (USERDOMAIN, COMPUTERNAME, APPDATA, LOCALAPPDATA, TEMP, PROGRAMDATA, npm_config_user_agent), packages them with the package name/version and a timestamp into a JSON blob, and ships the blob to a remote endpoint decoded from the obfuscated string array via HTTPS POST with a DNS-tunnel fallback (deliberate evasion of egress filtering). Before exfiltrating, the payload runs anti-analysis checks: it scans `process.argv` and `NODE_OPTIONS` against decoded tokens, requires `process.mainModule.filename` to match a decoded token, and executes a ~1e6-iteration `Date.now()` timing loop to detect sandboxes/debuggers, gating the exfil behind an internal flag. The combination of an obfuscated payload, anti-sandbox gating, dual exfil channels, a non-functional library shell, and an internal-scope cover story is unambiguous supply-chain malware. Any build system that mis-resolves the `@marketfront` scope to public npm will auto-run the stealer against its CI secrets, cloud tokens, and environment variables.\n","modified":"2026-07-06T05:16:45.565916351Z","published":"2026-07-02T00:00:00Z","database_specific":{"malicious-packages-origins":[{"sha256":"d15a354db253fd90616eb7e33d8c09dd7dd36b691259ec737182a96f9b5d65ab","versions":["7.0.0"],"id":"IN-MAL-2026-008029","import_time":"2026-07-06T04:58:10.878174448Z","source":"amazon-inspector","modified_time":"2026-07-06T03:20:46Z"}]},"references":[{"type":"REPORT","url":"https://safedep.io/marketfront-dependency-confusion-campaign/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@marketfront/errorcounter/v/7.0.0"}],"affected":[{"package":{"name":"@marketfront/errorcounter","ecosystem":"npm","purl":"pkg:npm/%40marketfront%2Ferrorcounter"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["7.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@marketfront/errorcounter/MAL-2026-6777.json","indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-VydRQeqRolA/ZLCR+9i0wg/uVbocBhu8IG8VcSx+nco5lSSzqAZ+5ncyXzOI3ZIDrJau5Md8bMKD4ZwJYlLLsA==","sha1":"7f5acf98ee832012b96b77e450a411ecae4ed66e"},"filename":"errorcounter-7.0.0.tgz"}],"evidence_files":[{"sha256":"81bfe9665c9a94ae1a97cf2c090810a1600ecf721e0b14d9dce781b47fc7640b","tlsh":"8ff3ca892740d443d95fdfbfbf61e6f4e0197cc6c3c1284af714b86ce89852a9a58b81","path":"scripts/postinstall.js"},{"sha256":"68c2e733a2300959fcd4b154b88bb8db7e29a67b94046b364f51094258e232df","tlsh":"6511aa31c6224c3336e5259abeb51902b9665d2b19a5fc0c63c3402c47ce16b21fe73d","path":"package.json"}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}