A supply chain attack compromised several Jscrambler NPM package versions by abusing stolen NPM publishing credentials. The attacker published malicious versions 8.16, 8.17, 8.18, and 8.20 containing a preinstall hook that executed setup.js, which loaded platform-specific Rust binaries (Linux, macOS, Windows). These binaries acted as information stealers targeting credentials, cloud and orchestration API keys, cryptocurrency wallets, AI coding assistants, messaging apps, browsers, and OS keyrings. The malware attempted privilege escalation, persistence, host reconnaissance, and exfiltrated data over TLS. The attack also impacted dependent packages including Jscrambler-webpack-plugin 8.6.2, gulp-Jscrambler 8.6.2, grunt-Jscrambler 8.5.2, and Jscrambler-metro-plugin 9.0.2. Jscrambler responded by revoking credentials, rotating secrets, and enhancing publishing security. The malicious versions were downloaded approximately 1,479 times before being deprecated and replaced with clean versions starting at 8.22.

The attack resulted in the distribution of malicious packages that, when installed, could steal a wide range of sensitive information including developer and cloud operator credentials, cryptocurrency wallets and seed phrases, AI assistant data, messaging and collaboration app data, browser sessions, Steam sessions, and OS keyrings. The malware also attempted to escalate privileges and maintain persistence on infected systems, potentially allowing ongoing unauthorized access and data exfiltration. This compromises the confidentiality and integrity of affected systems and credentials.

Jscrambler has revoked and rotated all relevant publishing credentials and secrets and implemented additional security controls around their publishing process. Users should immediately remove all affected Jscrambler NPM package versions (notably 8.16, 8.17, 8.18, and 8.20) from their environments, scan their systems for malware infections, and rotate all credentials, API keys, and tokens that may have been exposed. The first clean package version is 8.22; upgrading to this or later versions is recommended. No official patch beyond these steps is indicated; remediation relies on removing malicious versions and credential rotation.