Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install

Summary: The jscrambler npm package's 8.14.0 release, published July 11, 2026, carried a preinstall hook that dropped and ran a Rust infostealer built for Windows, macOS, and Linux; Socket flagged it six minutes after publication. Socket and JFrog tie five versions - 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0 - to the same actor, pushed over about three hours from a compromised npm publishing credential, with 8.18.0 and 8.20.0 moving the dropper into the package's main code so npm install --ignore-scripts does not stop it.
What you should know: The package sees about 15,800 downloads a week and its build-time role means the stealer's target list - AWS, Azure, and Google Cloud credentials including CI metadata endpoints, Bitwarden and 1Password vaults, and API keys in Claude Desktop, Cursor, and VS Code configs - is exactly what a CI runner holds. JFrog identifies the payload as IronWorm, which hunts npm tokens in .npmrc and environment variables and publishes infected tarballs straight to the registry via raw HTTP PUT, so a single unrotated token on a machine that ran 8.14.0 is the worm's next move.

Read the original at The Hacker News ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026