@marketfront/basemarkettemplate@7.0.0

Analysis

The package @marketfront/basemarkettemplate@7.0.0 is a trojanized hollow package. It ships no functional code — dist/index.js re-exports a non-existent file. The only payload is a 166KB heavily obfuscated postinstall script (scripts/postinstall.js) that uses javascript-obfuscator with anti-debugging, anti-tampering, and environment-detection checks. On install, the postinstall reads the NODE_OPTIONS environment variable, inspects process.argv, and loads additional modules via decoded require() calls. The README fabricates a fake company and claims to send "anonymous telemetry" to telemetry[.]marketfront[.]io as a cover story for C2 beaconing. No repository, no verifiable publisher identity.