Back safedep.io

Jscrambler

safedep.io • July 12, 2026

Official jscrambler npm CLI client (60K monthly downloads) trojanized across 5 versions (8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0) on 2026-07-11 via account or CI compromise. Attack evolved in real-time across versions: 8.14.0-8.17.0 use a preinstall hook (dist/setup.js); 8.17.0 adds pnpm allowScripts bypass; 8.18.0/8.20.0 pivot to require()-time injection in dist/index.js and dist/bin/jscrambler.js, bypassing --ignore-scripts entirely. All 5 versions drop an identical binary payload container (dist/intro.js, 7.8 MB) containing Rust-compiled multi-platform infostealers. Targets browser credentials, Bitwarden vault data, and Steam sessions. Persistence via Windows Task Scheduler and macOS LaunchAgents. Maintainers fought back with clean 8.15.0 and 8.22.0 to reclaim the latest dist-tag.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Jscrambler npm Package Compromised in Supply Chain Attack On July 11, 2026, multiple malicious versions of the jscrambler npm package were published, exploiting a compromised npm publishing credential. The affected versions (8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0) included a preinstall hook that deployed a Rust-based infostealer targeting sensitive data such as cloud credentials, CI tokens, and browser sessions. The attack evolved, with later versions embedding the malicious payload directly in the package code to evade detection. Jscrambler's response included immediate deprecation of the malicious versions and credential rotation. The package has approximately 15,800 weekly downloads, raising concerns about the potential impact on users. As of now, the latest clean version is 8.22.0, and the investigation is ongoing. 18 sources 74

Extracted Entities

Jscrambler

The full story

Extracted Entities

Attack Types (3)

MITRE ATT&CK (4)

Platforms (3)

Tools (1)