Originally published on CyberNetSec.
On July 11, 2026, a sophisticated software supply chain attack was identified involving the popular jscrambler
npm package. Multiple malicious versions were published to the npm registry using a compromised maintainer's publishing credential. These packages contained a cross-platform infostealer written in Rust, designed to harvest sensitive developer credentials. The malware targeted a wide range of secrets, including cloud provider credentials, cryptocurrency wallets, and configuration files for modern AI coding assistants. The incident highlights the significant risk of dependency confusion and credential compromise in the software development lifecycle. ** Jscrambler** has taken remedial action, but organizations are urged to audit their systems and rotate all potentially exposed secrets immediately.
The attack began with the publication of jscrambler
version 8.14.0
to the ** npm** registry, followed by several other malicious versions (
8.16.0
, 8.17.0
, 8.18.0
, 8.20.0
). The threat actor leveraged a compromised npm publishing token to push these versions directly to the registry, bypassing the project's standard code review process on GitHub. The initial attack vector was an npm preinstall
script, which automatically executed upon package installation (npm install
). This script unpacked and ran a native binary infostealer. Later versions adapted to use require()
-time injection to evade detection mechanisms that block installation scripts.The primary goal of the attack was credential theft from developer workstations and CI/CD environments. The malware was specifically designed to be cross-platform, with executables for Windows, macOS, and Linux.
The attack chain demonstrates a clear understanding of developer workflows and security blind spots.
jscrambler
package, allowing them to publish new versions. This aligns with T1195.002 - Compromise Software Supply Chain
preinstall
hook in the package.json
file. This hook ran a setup script that deployed the infostealer payload. This is a form of T1059 - Command and Scripting Interpreter
intro.js
). It contained compressed executables for Windows, macOS, and Linux.T1552.005 - Cloud Credentials
T1552.001 - Credentials In Files
T1053.005 - Scheduled Task/Job: Scheduled Task
T1543.001 - Create or Modify System Process: Launch Agent
The impact of this attack is potentially severe. Any developer or CI/CD system that installed one of the malicious jscrambler
versions could have had their credentials compromised. Stolen cloud credentials could lead to significant data breaches, unauthorized resource usage, and further lateral movement into corporate networks. The theft of AI coding tool credentials is a novel and concerning development, as it could allow attackers to access proprietary code, inject malicious code via the AI assistant, or abuse paid API quotas. The compromise of cryptocurrency wallets could result in direct financial loss for affected individuals.
No specific file hashes, IP addresses, or C2 domains were mentioned in the source articles.
Security teams may want to hunt for the following patterns to identify potentially related activity:
| Type | Value | Description |
|---|---|---|
| file_name | intro.js |
|
| The name of the malicious binary payload, though it is not a JS file. | ||
| command_line_pattern | npm install jscrambler@8.14.0 |
|
| Or any of the other compromised versions. | ||
| log_source | CI/CD build logs |
|
Look for installations of the malicious jscrambler versions. |
||
| process_name | node.exe |
|
| Monitor for child processes spawning unexpected binaries or making outbound network connections to unusual destinations. | ||
| registry_key | HKCU\Software\Microsoft\Windows\CurrentVersion\Run |
|
| Check for suspicious entries related to persistence on Windows. | ||
| file_path | ~/Library/LaunchAgents/ |
|
Check for new or suspicious .plist files on macOS. |
Security teams should focus on detecting the installation and execution of the malicious packages.
package.json
and package-lock.json
files for known malicious versions. Tools like preinstall
scripts.npm
or node
processes that spawn unexpected child processes or write executable files. Monitor for the creation of scheduled tasks or launch agents immediately following an npm install
command. A relevant D3FEND technique is D3-PA - Process Analysis
D3-NTA - Network Traffic Analysis
Preventing and mitigating such supply chain attacks requires a multi-layered approach.
package-lock.json
or yarn.lock
to ensure that npm install
uses a specific, vetted version of a dependency.npm audit
to check for known vulnerabilities. Use tools that analyze package behavior, not just known CVEs.npm install
with the --ignore-scripts
flag in environments where pre/post-install scripts are not expected or necessary. This is a form of M1038 - Execution Prevention
M1032 - Multi-factor Authentication
M1026 - Privileged Account Management