Compromised Jscrambler npm Releases Deliver Cross-Platform Infostealer

Article Details

Attack Vectors

• Jscrambler confirmed that an attacker used an npm publishing credential to publish unauthorized jscrambler releases: 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0.
• Versions 8.14.0, 8.16.0, and 8.17.0 execute the dropper through a preinstall hook invoking node dist/setup.js, requiring neither package import nor CLI execution.
• Versions 8.18.0 and 8.20.0 inject the dropper as a self-executing function into dist/index.js and dist/bin/jscrambler.js. Execution occurs on package import or CLI use, bypassing install-hook-only inspection and npm install --ignore-scripts.
• Versions 8.18.0 and 8.20.0 declare a self-dependency on jscrambler ^8.17.0, allowing a compromised release to be pulled transitively.
• The dropper selects a gzip-compressed native executable from dist/intro.js according to process.platform, writes it to a randomly named hidden temporary file, marks it executable, and launches it as a detached background process.
• The Rust-built payloads target developer credentials and secrets, including wallet vaults and seed phrases, AI-tool and MCP configurations, cloud credentials, messaging accounts, browser data, Steam sessions, and OS keyrings.
• Static analysis confirmed TLS-based outbound exfiltration using a multipart POST /upload request. The payload also constructs cloud and orchestration API requests using stolen credentials.

Defensive Notes

• The updated recommendation is to upgrade or pin jscrambler to 8.22.0, which the article identifies as clean. Versions 8.13.0 and 8.15.0 are also identified as clean releases.
• Audit every machine that installed jscrambler 8.14.0, 8.16.0, 8.17.0, 8.18.0, or 8.20.0, including developer workstations, automated build systems, and CI environments.
• Remove affected releases and rotate credentials accessible to affected development or CI environments.
• Review installation logs for execution of dist/setup.js, while accounting for later releases that execute through package imports or CLI invocation instead of installation hooks.
• Do not rely on npm install --ignore-scripts or inspection limited to preinstall/postinstall hooks to prevent execution of the later malicious releases.
• Jscrambler reported revoking and rotating publishing credentials and related secrets, deprecating affected releases, and adding publishing-process controls.
• Socket detected and flagged the initial malicious release six minutes after publication. The number of users who installed compromised versions was not known.