@marketfront/actualordersnippetpopup@7.0.0

Analysis

Package @marketfront/actualordersnippetpopup@7.0.0 is a trojanized dotenv impersonator. It ships a 160KB javascript-obfuscator-obfuscated postinstall script (scripts/postinstall.js) with anti-debug/tamper detection, hex-escaped strings, and atob usage — wildly disproportionate to its declared telemetry purpose. The package has no actual source code (dist/index.js references a non-existent src/index.js), zero dependencies despite claiming to be a dotenv wrapper, and uses a fabricated company identity (marketfront[.]io — a custom domain, not a real company). The obfuscated postinstall likely exfiltrates environment variables from the installer's system.