T1195.001: npm Install of @marketfront or @tqm-mfe Scoped Packages

Tim Peck@timpeck

•updated Jul 6, 2026•0•0•8

Detects execution of 'npm install' or 'npm ci' commands that explicitly include '@marketfront' or '@tqm-mfe' scopes. This detection is designed to identify potential dependency confusion attacks where malicious actors publish public packages with the same names as internal private packages to trick build systems into downloading malicious code instead of legitimate internal modules.