{"id":"MAL-2026-6785","summary":"Malicious code in @marketfront/madvpopup (npm)","details":"The @marketfront/madvpopup package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' (marketfront@tutamail.com) within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use e-commerce/marketing frontend component names as cover.\n\nThe package declares a postinstall hook (node scripts/postinstall.js) that executes heavily obfuscated (obfuscator.io-style) code automatically at npm install time. Static analysis of the decoded payload revealed a credential harvester that dynamically requires fs, os, http, https, zlib, path and dns, then reads approximately 20 sensitive credential files including ~/.ssh, ~/.aws/credentials, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.netrc, ~/.pgpass, ~/.git-credentials, ~/.env and ~/.bash_history. Collected data is exfiltrated via a gzip-compressed HTTPS POST with a custom X-Secret header to the path /api/v1/events, alongside a DNS resolver beacon. The command-and-control host is concealed behind an additional RC4+XOR encryption layer around an embedded configuration blob and was not statically resolved.\n\nThe decoded behavioral payload (module requires, credential-file target list, exfiltration headers and endpoint) is byte-for-byte identical across sampled packages in the campaign. The campaign shares tooling and infrastructure patterns (obfuscated postinstall credential harvester, X-Secret header, /api/v1/events exfiltration path, RC4-concealed C2) with the earlier @emcd-vue campaign, indicating the same actor rotating scopes and disposable maintainer emails.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7a5356e994576873d423448281716731228660a884a5adf5cb7327dc7520a2e2)\nPackage declares `postinstall: node scripts/postinstall.js`. scripts/postinstall.js is a 162KB obfuscator.io-style payload (string-array + RC4 + base64 decoders, per-call scope aliases, and anti-debug: NODE_OPTIONS inspection, inspector-module check, Date.now() tight-loop timing probe gating execution via a global flag). On `npm install` the script collects hostname, network interfaces, cwd, uid/gid, home, tmpdir, uptime, username, npm_config_user_agent, Windows-specific variables (USERDOMAIN, COMPUTERNAME, PROCESSOR_ARCHITECTURE, APPDATA, LOCALAPPDATA, PROGRAMDATA, TEMP), and the full `process.env`, and POSTs them over HTTPS to a hardcoded (obfuscated) remote endpoint. A dedicated helper iterates `process.env` against a large embedded allowlist of credential-shaped variable names (AWS/DB/CI/token patterns) and includes matches in the outbound payload — direct credential harvest against installer machines and CI runners where cloud/registry tokens live in the environment. The library surface is non-functional cover: `dist/index.js` re-exports `../src/index.js`, which is not shipped in the tarball; the only executable code is the postinstall. Scope and metadata (`@marketfront/`, homepage `docs.marketfront.io`, repo `github.marketfront.io`, bugs `jira.marketfront.io`, README instructing `.npmrc` redirect to `npm.marketfront.io`) impersonate an internal-corporate namespace, consistent with a dependency-confusion attack against a specific organization's developers.\n","modified":"2026-07-06T05:16:46.474552794Z","published":"2026-07-02T00:00:00Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-008034","import_time":"2026-07-06T04:58:11.063659934Z","modified_time":"2026-07-06T03:21:27Z","sha256":"7a5356e994576873d423448281716731228660a884a5adf5cb7327dc7520a2e2","versions":["7.0.0"],"source":"amazon-inspector"}]},"references":[{"type":"REPORT","url":"https://safedep.io/marketfront-dependency-confusion-campaign/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@marketfront/madvpopup/v/7.0.0"}],"affected":[{"package":{"name":"@marketfront/madvpopup","ecosystem":"npm","purl":"pkg:npm/%40marketfront%2Fmadvpopup"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["7.0.0"],"database_specific":{"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","tlsh":"fff3ec892740d497d85fdebf7f61e6f0e1197cc6c3c1284af714b86cf89852a9a48b81","sha256":"630e75c79ed081c2d24fe34555eb97c293f46d4f4e9d1b472210656a2abe0324"},{"path":"package.json","tlsh":"0311c036c6215c3376d525dabdb42e01b9650c2b2856fc1c23c3406c4b8d16f21fd67d","sha256":"1eb9e5d18f05df393722f5fac63da1f543be1632d0e2692ae4a5c6316d23f760"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-HlUrRZmZhhPxzJH3zgsDhRBVgnansL977H7soNIMMOiMQ3Wt9KxFebGiRxYoBbz6g7zUHZG97YaHkUB6j92wmg==","sha1":"664e78999d6e53a4e826c103f31c24ff49d63755"},"filename":"madvpopup-7.0.0.tgz"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@marketfront/madvpopup/MAL-2026-6785.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}