Supply-Chain Attack Publishes Malicious Jscrambler NPM Packages

Attackers used stolen NPM publishing credentials beginning July 11 to push multiple malicious versions of the Jscrambler package. The compromised releases included versions 8.16, 8.17, 8.18 and 8.20. NPM records show those builds were downloaded 1,479 times before they were deprecated and replaced with a clean release, 8.22.

The malicious package added a preinstall hook and two new files under dist/ that triggered an installation chain. A setup script executed a platform-specific binary referenced in intro.js. Security firm Socket analyzed the files and reported the binaries, compiled in Rust, targeted Linux, macOS and Windows hosts and acted as information stealers.

Socket’s analysis identified attempts to collect credentials and secrets from developer and cloud-operator machines, cryptocurrency wallets and seed phrases, AI coding assistants, MCP server configurations, messaging and collaboration apps, web browsers, Steam sessions and operating system keyrings. The malware also attempted privilege escalation, persistence and host reconnaissance. Socket observed the harvested data being exfiltrated over TLS using rustls, likely to a remote drop server, and noted the malicious code constructed requests to query cloud and orchestration APIs with any stolen credentials.

Because Jscrambler is a dependency for other modules, related packages were affected. The incident touched Jscrambler-webpack-plugin version 8.6.2, gulp-Jscrambler version 8.6.2, grunt-Jscrambler version 8.5.2 and Jscrambler-metro-plugin version 9.0.2.

Jscrambler reported that its investigation indicates the attacker published the package using an NPM publishing credential. The company revoked and rotated the relevant publishing credentials, passwords and secrets and implemented additional controls around its publishing process while the investigation continues.

Security teams and developers are advised to remove the listed Jscrambler package versions from local machines and build environments, perform full malware scans on endpoints and build hosts, and rotate credentials, tokens and API keys that may have been exposed. Examining build logs for unexpected preinstall activity and checking CI/CD secrets is recommended to detect potential misuse of publishing credentials.

A single compromised publish can propagate through dependent projects and continuous integration pipelines, creating downstream exposure. Users and downstream projects should treat any use of the affected versions as compromised and update to the clean release, 8.22.