Jscrambler disclosed that a threat actor published malicious versions of its npm package, injecting an info‑stealer that was downloaded roughly 1,500 times. The company removed the compromised packages within two hours and released a secure update.

Key Takeaways

  • Malicious Jscrambler npm versions were downloaded 1,479 times in a two‑hour window
  • Malware exfiltrated source code, cloud credentials, crypto wallets, and messaging data
  • Jscrambler revoked compromised publishing credentials and added extra pipeline safeguards

Jscrambler, a client‑side web security platform that obfuscates JavaScript, announced on Saturday that a threat actor had published malicious versions of its npm package (releases 8.14, 8.16, 8.17, and 8.20). The malicious code executed during the preinstall hook, stealing a wide range of sensitive data from developers’ environments.

Scope of the Attack

According to Node Package Manager statistics, the compromised package was downloaded 1,479 times within a two‑hour window before the maintainer deprecated it and issued a clean version (8.22). Four other Jscrambler packages depended on the tainted release; those dependencies were also deprecated and replaced.

Technical Details of the Malware

Security firm Socket, which investigated the breach, found that the infostealer employed per‑string obfuscation using the ChaCha20‑Poly1305 encryption algorithm, making reverse‑engineering extremely difficult. The malware targeted: source code and project files; developer credentials (Git, SSH, environment variables, CI/CD tokens); cloud secrets from AWS, Azure, GCP, and Kubernetes; AI coding tool configurations (Claude, Cursor, Windsurf, VS Code, Zed); cryptocurrency wallets and seed phrases (MetaMask, Phantom, Coinbase, Exodus, Trust Wallet); browser data such as cookies and saved credentials; and messaging platforms like Slack, Discord, and Telegram.

Jscrambler’s Response

Jscrambler emphasized that the incident was limited to the npm package and did not affect its other products, including Webpage Integrity. The company revoked the compromised publishing credentials, reinforced its publishing pipeline with additional security controls, and urged customers to upgrade to the latest version (8.22).

Recommendations for Developers

Developers who installed the malicious versions should treat their environments as compromised: rotate all secrets, validate CI/CD pipelines, and restore from trusted backups. This supply‑chain breach underscores the need for continuous monitoring of third‑party dependencies and stricter credential management across the software development lifecycle.