Jscrambler npm Supply Chain Attack Steals Developer and Cloud Credentials

A compromised release of the widely used jscrambler npm package has exposed developers and CI pipelines to a sophisticated credential-stealing campaign, after attackers hijacked the maintainers’ publishing credentials to push malicious code disguised as a routine update.

Socket’s Research Team detected the malicious jscrambler@8.14.0 release just six minutes after it went live on July 11, 2026.

The package, which integrates Jscrambler’s JavaScript obfuscation tooling into build pipelines and receives roughly 15,800 weekly downloads, added an undocumented preinstall hook that executed dist/setup.js automatically during npm install.

Jscrambler npm Supply Chain Attack

The malicious release bundled dist/intro.js, an approximately 7.8 MB file disguised as a .js file but actually a custom binary container containing three gzip-compressed native executables for Linux, macOS, and Windows.

The setup.js loader selected the binary matching the victim’s operating system, decompressed it into a randomly named, hidden file in the system temp directory, and launched it as a detached process, hidden from the user.

The dropped payloads were Rust-built infostealers targeting an extensive range of developer and cloud assets.

On the cryptocurrency front, they targeted browser-extension wallets, including MetaMask, Trust Wallet, Coinbase Wallet, and Phantom, as well as the Exodus wallet, using logic designed to extract seed phrases and mnemonic vaults by leveraging scrypt key-derivation parameters rather than simply copying files.

The malware also enumerated configuration for AI coding assistants such as Claude Desktop, Cursor, Windsurf, Zed, and VS Code, since these tools frequently store API keys and Model Context Protocol server credentials.

Cloud credentials were another major target, with the payload probing metadata and secrets endpoints across AWS, GCP, and Azure.

Beyond that, it accessed browser data, Discord and Slack tokens, Telegram sessions, Steam login secrets, and OS keyrings, and attempted privilege escalation via sudo and systemd-run.

Sensitive strings inside the binaries were individually encrypted with ChaCha20-Poly1305, and Socket’s analysts recovered roughly 2,400 of them through cryptographic decryption rather than static string extraction, a sign of deliberate anti-analysis engineering.

Socket confirmed that exfiltration occurred over TLS to a drop server via a multipart HTTP POST request. The threat actor didn’t stop after the initial release.

Over the following three hours, four more malicious versions appeared, numbered 8.16.0, 8.17.0, 8.18.0, and 8.20.0, carrying an identical payload but shifting delivery method.

Starting with 8.18.0, the attacker abandoned the install hook entirely, instead injecting the dropper as a self-executing function inside dist/index.js and the CLI binary.

This change defeats scanners that only inspect install scripts and bypasses the protection offered by npm install –ignore-scripts. Two of the later versions also declared a self-referential dependency, pulling in a compromised release transitively even when a clean version was specified.

Jscrambler confirmed the breach in a security advisory, stating that the attacker published packages using a stolen npm publishing credential.

The company has since revoked and rotated its credentials and hardened its publishing process. Version 8.22.0 is confirmed clean, and 8.15.0 was also a safe interim release.

Mitigation

Organizations that may have installed jscrambler between versions 8.14.0 and 8.20.0 should treat any affected machine as potentially compromised.

The immediate priority is to remove those versions and upgrade to 8.22.0 or pin back to the last verified clean release, 8.13.0. Because the malware harvested credentials broadly, teams should rotate every credential accessible to affected environments.

Installation logs should be reviewed for the execution of dist/setup.js, unexpected hidden binaries in temp directories, and configuration files for AI coding tools.

The incident underscores a growing trend in which attackers increasingly target developer machines specifically, since these systems hold the keys to cloud infrastructure, CI/CD pipelines, and now AI tooling credentials, making npm supply chain compromises an especially high-value entry point for large-scale credential theft.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post Jscrambler npm Supply Chain Attack Steals Developer and Cloud Credentials appeared first on Cyber Security News.