A supply chain attack compromised the jscrambler npm package by publishing malicious versions that introduced an undocumented preinstall hook executing a setup script. This script deployed platform-specific native binaries embedded in an obfuscated container, which function as a Rust-built infostealer. The malware targets a broad range of sensitive information including cryptocurrency wallets, AI coding assistants, cloud service credentials (AWS, GCP, Azure), browser data, and messaging applications. The attacker released five malicious versions within a short timeframe, adapting delivery methods to avoid detection. The clean version 8.22.0 is available, indicating remediation through package updates. The attack affects developer workstations, continuous integration systems, and build pipelines that install the compromised package.

The compromised jscrambler npm package versions enable automatic execution of malicious native binaries during installation, leading to theft of highly sensitive data such as cryptocurrency wallets, cloud credentials, browser data, and messaging app information. This threatens the confidentiality of developer environments and automated build systems that rely on this package, potentially exposing critical secrets and credentials to attackers. The supply chain nature of the attack increases risk due to the package's widespread use and trust in npm packages.

Users and organizations should immediately upgrade to jscrambler version 8.22.0 or later, which is confirmed clean. Avoid using the compromised versions 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0. Review build and CI pipelines for any installations of these malicious versions and rotate any credentials or secrets that may have been exposed. Monitor for indicators of compromise using the provided hashes. Patch status is confirmed by the availability of a clean version (8.22.0).