Malicious Jscrambler npm Releases Delivered an Infostealer
Summary
Jscrambler says malicious releases of its npm package were downloaded 1,479 times before removal. The package ran an infostealer during installation; the company revoked publishing credentials and released safe version 8.22.
Key points
- Jscrambler disclosed unauthorized malicious releases 8.14, 8.16, 8.17, and 8.20 of its npm package.
- The releases were downloaded 1,479 times during a roughly two-hour window.
- An infostealer ran through the package's preinstall hook and targeted developer secrets, cloud credentials, browser data, messaging apps, and cryptocurrency wallets.
- Socket detected the compromise and reported that the malware used ChaCha20-Poly1305 encryption for per-string obfuscation.
- Jscrambler said the compromise was limited to the jscrambler package used by its Code Integrity product; four dependent packages were also deprecated and replaced.
- The company revoked publishing credentials, added publishing-pipeline security controls, and released safe version 8.22.
- Jscrambler advises users of the malicious packages to treat their environments as compromised, rotate secrets, and restore from safe backups.
Article Details
- Event Type
- Software supply-chain compromise involving a malicious npm package
- Impact
- A malicious jscrambler package release delivered an infostealer through its preinstall hook and was downloaded 1,479 times during a two-hour window. It targeted developer secrets, cloud credentials, source code, browser data, messaging apps, AI-tool configurations, and cryptocurrency wallet data. Jscrambler revoked the compromised publishing credentials, deprecated the affected releases and dependent packages, and released safe version 8.22.