@marketfront/changefilter@7.0.0

Analysis

On install, the postinstall hook (scripts/postinstall.js) executes a 164KB javascript-obfuscator-obfuscated payload. The package poses as an internal configuration loader but is published publicly on npm. The postinstall script sends telemetry to telemetry[.]marketfront[.]io and executes obfuscated code. The package has no repository, no prior versions, and uses a fake internal infrastructure domain (github[.]marketfront[.]io). The same publisher simultaneously published @marketfront/actualordersnippetpopup@7.0.0 with an identical obfuscated postinstall payload, which has been independently confirmed as malware.