# Malicious 'jscrambler' NPM Package Versions Deploy Cross-Platform Infostealer in Sophisticated Supply Chain Attack > Source: > Published: 2026-07-12 19:24:43+00:00 *Originally published on CyberNetSec.* On July 11, 2026, a sophisticated software supply chain attack was identified involving the popular `jscrambler` npm package. Multiple malicious versions were published to the npm registry using a compromised maintainer's publishing credential. These packages contained a cross-platform infostealer written in Rust, designed to harvest sensitive developer credentials. The malware targeted a wide range of secrets, including cloud provider credentials, cryptocurrency wallets, and configuration files for modern AI coding assistants. The incident highlights the significant risk of dependency confusion and credential compromise in the software development lifecycle. ** Jscrambler** has taken remedial action, but organizations are urged to audit their systems and rotate all potentially exposed secrets immediately. The attack began with the publication of `jscrambler` version `8.14.0` to the ** npm** registry, followed by several other malicious versions ( `8.16.0` , `8.17.0` , `8.18.0` , `8.20.0` ). The threat actor leveraged a compromised npm publishing token to push these versions directly to the registry, bypassing the project's standard code review process on GitHub. The initial attack vector was an npm `preinstall` script, which automatically executed upon package installation (`npm install` ). This script unpacked and ran a native binary infostealer. Later versions adapted to use `require()` -time injection to evade detection mechanisms that block installation scripts.The primary goal of the attack was credential theft from developer workstations and CI/CD environments. The malware was specifically designed to be cross-platform, with executables for Windows, macOS, and Linux. The attack chain demonstrates a clear understanding of developer workflows and security blind spots. `jscrambler` package, allowing them to publish new versions. This aligns with `T1195.002 - Compromise Software Supply Chain` `preinstall` hook in the `package.json` file. This hook ran a setup script that deployed the infostealer payload. This is a form of `T1059 - Command and Scripting Interpreter` `intro.js` ). It contained compressed executables for Windows, macOS, and Linux.`T1552.005 - Cloud Credentials` `T1552.001 - Credentials In Files` `T1053.005 - Scheduled Task/Job: Scheduled Task` `T1543.001 - Create or Modify System Process: Launch Agent` The impact of this attack is potentially severe. Any developer or CI/CD system that installed one of the malicious `jscrambler` versions could have had their credentials compromised. Stolen cloud credentials could lead to significant data breaches, unauthorized resource usage, and further lateral movement into corporate networks. The theft of AI coding tool credentials is a novel and concerning development, as it could allow attackers to access proprietary code, inject malicious code via the AI assistant, or abuse paid API quotas. The compromise of cryptocurrency wallets could result in direct financial loss for affected individuals. No specific file hashes, IP addresses, or C2 domains were mentioned in the source articles. Security teams may want to hunt for the following patterns to identify potentially related activity: | Type | Value | Description | |---|---|---| | file_name | `intro.js` | The name of the malicious binary payload, though it is not a JS file. | | command_line_pattern | `npm install jscrambler@8.14.0` | Or any of the other compromised versions. | | log_source | `CI/CD build logs` | Look for installations of the malicious `jscrambler` versions. | | process_name | `node.exe` | Monitor for child processes spawning unexpected binaries or making outbound network connections to unusual destinations. | | registry_key | `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` | Check for suspicious entries related to persistence on Windows. | | file_path | `~/Library/LaunchAgents/` | Check for new or suspicious `.plist` files on macOS. | Security teams should focus on detecting the installation and execution of the malicious packages. `package.json` and `package-lock.json` files for known malicious versions. Tools like `preinstall` scripts.`npm` or `node` processes that spawn unexpected child processes or write executable files. Monitor for the creation of scheduled tasks or launch agents immediately following an `npm install` command. A relevant D3FEND technique is `D3-PA - Process Analysis` `D3-NTA - Network Traffic Analysis` Preventing and mitigating such supply chain attacks requires a multi-layered approach. `package-lock.json` or `yarn.lock` to ensure that `npm install` uses a specific, vetted version of a dependency.`npm audit` to check for known vulnerabilities. Use tools that analyze package behavior, not just known CVEs.`npm install` with the `--ignore-scripts` flag in environments where pre/post-install scripts are not expected or necessary. This is a form of `M1038 - Execution Prevention` `M1032 - Multi-factor Authentication` `M1026 - Privileged Account Management`