Threats · 62 days ago
A one-version cleanup was never enough here. The attacker kept publishing fresh malicious Jscrambler releases while defenders were already responding, so the exposure expanded beyond the first bad package and into later versions still in circulation. The install step is the trap: it runs before any app code, which lets the package steal secrets from developer and build machines as soon as it is installed.
Jscrambler says the malicious versions include 8.14.0, 8.16, 8.17, 8.18, and 8.20, with 8.22 the first clean release. SecurityWeek also says the impact reached downstream packages: jscrambler-webpack-plugin 8.6.2, gulp-jscrambler 8.6.2, grunt-jscrambler 8.5.2, and jscrambler-metro-plugin 9.0.2. The payload targets credentials, tokens, wallets, browser sessions, and cloud secrets on Linux, macOS, and Windows hosts.
The practical risk is credential spillover, not just a tainted npm artifact. Any build or developer host that installed one of the malicious releases should be treated as a source of compromised secrets, because the attacker already had a path to exfiltrate standing credentials before the app ever ran.
4 sources covering this story
Multiple Jscrambler Packages Impacted by Supply Chain Attack
A threat actor poisoned several Jscrambler NPM package versions to drop a cross-platform credential stealer.
Hackers backdoor Jscrambler npm package with infostealer malware
The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm package that has been downloaded almost 1,500 times.
Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install
Malicious jscrambler 8.14.0 runs hidden binaries during npm install on Windows, macOS, and Linux, with no fix available as of July 11, 2026.
jscrambler npm Package Compromised in Supply Chain Attack - ...
A compromised jscrambler npm release added a malicious preinstall hook that runs hidden native binaries on Linux, macOS, and Windows.
Part of the PlainSec briefing for 2026-07-15