@marketfront/advertisingdevtool@7.0.0

Analysis

The package @marketfront/advertisingdevtool@7.0.0 runs a heavily obfuscated postinstall script (scripts/postinstall.js, 166KB) on installation. The script is obfuscated with javascript-obfuscator, uses anti-debug timing checks, reads process.argv and process.env, and makes dynamic require() calls with obfuscated module names. The README states the package sends telemetry to telemetry[.]marketfront[.]io on install. The package has no actual source code (dist/index.js re-exports a non-existent src/index.js), no dependencies, and the repository URL points to a fake github[.]marketfront[.]io domain. The obfuscated postinstall script is a C2 beacon that phones home to telemetry[.]marketfront[.]io.