Tia N.List

Reported by 1 outlet

Jscrambler npm Supply Chain Compromise — Infostealer in 4 Package Releases

hot0.0
Why this score
Breadth
0.50 / 2.0 · 1 source
Authority
1.80 / 2.0 · best outlet weight
Severity
0.80 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.00 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
bleepingcomputer.com first seen 92d ago

Timeline

  1. original reporting

    Jscrambler npm Supply Chain Compromise — Infostealer in 4 Package Releases

    bleepingcomputer.com · 92d ago · July 14th, 2026

    Jscrambler disclosed that an attacker compromised its npm publishing credentials and pushed malicious versions of the jscrambler package spanning releases 8.14, 8.16, 8.17, and 8.20. The malicious package included an infostealer executing during the preinstall hook, downloaded 1,479 times during the two-hour window before the compromise was detected and the safe version 8.22 was published.

    The infostealer used ChaCha20-Poly1305 per-string obfuscation and targeted:

    • Source code, developer credentials (Git, SSH, environment variables, CI/CD tokens)

    • Cloud credentials (AWS, Azure, GCP, Kubernetes secrets)

    • AI tool configurations (Claude, Cursor, Windsurf, VS Code, Zed)

    • Cryptocurrency wallets (MetaMask, Phantom, Coinbase, Exodus, Trust Wallet)

    • Browser data and messaging apps (Slack, Discord, Telegram)

    Four dependent Jscrambler packages were also deprecated and replaced. Any developer who installed versions 8.14–8.20 should treat their environment as compromised — rotate all secrets, audit CI/CD pipelines, and restore from safe backups.

Covered in

digest 2026-07-14

Source on GitHub