Compromised jscrambler npm releases dropped a cross-platform infostealer on install

Attackers used a stolen publishing credential to push malicious versions of the jscrambler npm package that install a Rust infostealer as soon as the package is added to a project. Socket ties five bad versions to the same actor, published over about three hours; the malware ships as native binaries for Windows, macOS, and Linux and sweeps developer machines for cloud credentials, crypto wallets, and password-manager vaults. Because jscrambler is a build-time tool used in development and CI, the stealer runs where deploy tokens, cloud keys, and source code live. Partway through, the dropper moved into the package's main code, so installing with scripts disabled does not stop it.

Check

Check lockfiles, package logs, and CI records for the malicious jscrambler versions installed since July 11, move to a clean release or pin to 8.13.0, and clear affected versions from caches.

Affected

Developers and CI pipelines that installed the malicious jscrambler versions; the infostealer captures AWS, Azure, and Google Cloud credentials, crypto wallets and seed phrases, and password-manager vaults from the build environment.

Fix

Remove the bad versions, rotate every credential exposed in affected developer and CI environments, hunt for temp-directory binaries and hidden persistence, and pin and verify dependencies rather than trusting a maintainer account.