jscrambler

The jscrambler npm package was backdoored five times in three hours on July 11, 2026, after a threat actor stole an npm publishing credential. The malicious versions (8.14.0–8.20.0, excluding 8.15.0) …

On July 11, 2026, a supply chain attack compromised the popular jscrambler npm package, with malicious versions deploying a cross-platform infostealer written in Rust. The malware targeted developer c…

A malicious version of the npm package jscrambler used a preinstall hook to deploy a Rust infostealer on developer machines. The attack targeted browser credentials, crypto wallets, and Bitwarden vaul…