Loading story…
The npm package jscrambler was compromised through malicious version 8.14.0, which added an undocumented preinstall hook and install-time files that executed hidden native binaries on Windows, macOS, and Linux during npm install, before application code ran. Researchers said the release appeared to be published directly to npm from a legitimate maintainer account without matching source repository commits or tags, pointing to a likely compromise of the maintainer account or build pipeline. Socket reported detecting the release within minutes of publication and alerted the maintainers, while a subsequent 8.15.0 release appeared clean.
Further analysis linked the package to a Rust-based infostealer aimed at developer workstations and CI/build environments, creating exposure for source code, environment variables, build credentials, deployment tokens, and other secrets. Reported targets included cloud credentials, browser data, messaging sessions, cryptocurrency wallets, Bitwarden vault contents, and configuration files for AI coding tools such as Claude Desktop, Cursor, Windsurf, VS Code, and Zed. Researchers also observed anti-debugging on Windows and macOS, Linux eBPF capability, persistence through Windows scheduled tasks and macOS LaunchAgents, and encrypted command-and-control details; because 8.14.0 remained available on npm, pinned installs on older npm clients that still run install scripts could continue to trigger the payload.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Jscrambler disclosed that the supply-chain compromise extended beyond the main jscrambler package to dependent packages including jscrambler-webpack-plugin, gulp-jscrambler, grunt-jscrambler, and jscrambler-metro-plugin. This expanded the scope of the incident to multiple related npm packages.
Jscrambler said an attacker used an npm publishing credential to upload the unauthorized releases. The company responded by revoking credentials, deprecating the affected versions, and publishing a clean 8.22.0 release.
Jscrambler said the unauthorized malicious jscrambler npm releases were available for roughly two hours and were downloaded about 1,479 times. The company advised affected users to treat their environments as compromised, rotate secrets, restore from safe backups, and update to safe versions.
JFrog assessed the malware in the compromised jscrambler releases as an evolved IronWorm variant. Its analysis also found code that attempted to steal npm tokens and republish trojanized packages to the npm registry, indicating possible self-propagation across the ecosystem.
Reporting identified further compromised jscrambler npm releases—8.16.0, 8.17.0, 8.18.0, and 8.20.0—after the initial 8.14.0 incident. These later versions reportedly shifted the malware from an install-time hook into the CLI execution path, continuing delivery of a cross-platform Rust-based infostealer.
Version 8.15.0 was released as a replacement for the compromised 8.14.0 package and was reported to appear clean. However, the malicious 8.14.0 version remained available on npm, leaving pinned installs and older npm clients at risk if they still executed install scripts.
Socket detected the malicious jscrambler 8.14.0 release six minutes after it was published and reported the issue to the package maintainers. The detection identified the new install-time behavior as a supply-chain compromise affecting developer workstations and CI/build environments.
A compromised version of the npm package jscrambler, 8.14.0, was published to npm with an undocumented preinstall hook and install-time files that executed hidden native binaries on Windows, macOS, and Linux. Reporting indicates the release was likely pushed from a legitimate maintainer account without matching source repository commits or tags.
Aikido reported that the Rust crate onering was compromised and performed code exfiltration. This introduces a separate affected package outside the previously documented jscrambler npm incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
15 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcesecurityweek.com
Open sourcethecybersecguru.com
Open sourcescworld.com
Open sourcesocket.dev
Open sourcegithub.com
Open sourcejscrambler.com
Open sourceaikido.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported two separate npm supply-chain compromises that delivered malware and exploit infrastructure to downstream users. One analysis uncovered an obfuscated Node.js stealer designed to run across **Windows via WSL, macOS, and Linux**, with plaintext modules for browser credential theft, recursive exfiltration of sensitive files, and a **WebSocket-based reverse shell**. The malware targeted Chromium-based browsers and cryptocurrency wallet extensions, sent browser data, files, and command traffic to `216.126.225.243` over ports `8085`, `8086`, and `8087`, and included host profiling plus an `HMAC-SHA256` routine with a hardcoded key. Researchers noted the command-and-control IP had previously been associated with **DPRK-linked OtterCookie** infrastructure. In a separate incident, Socket Threat Research said the widely used npm package **`art-template`** was compromised after repository control was transferred to an unknown actor, who inserted malicious remote-script loaders into versions **`4.13.5`** and **`4.13.6`**. The injected code redirected users to a watering-hole framework at `utaq.cfww.shop` that selectively targeted **Safari on iOS 11.0 through 17.2**, beaconed device and IP data to `l1ewsu3yjkqeroy.xyz`, and used anti-bot checks, anti-headless logic, and **WebAssembly-based fingerprinting** before retrieving gated payloads. Researchers found strong overlap with the **Coruna exploit kit**, including version-aware targeting, XOR obfuscation, architecture-specific dispatch, and a cutoff at **iOS 17.3**, with additional similarities noted to **UNC6691**.
Jun 29, 2026
Security researchers have uncovered multiple campaigns involving malicious npm packages designed to steal developer credentials and sensitive information from Windows, macOS, and Linux systems. In one operation, ten typosquatted packages impersonated popular libraries such as TypeScript, discord.js, ethers.js, and others, using sophisticated obfuscation, fake CAPTCHA prompts, and postinstall hooks to deploy an information stealer that harvested credentials from system keyrings, browsers, and authentication services. The malware executed in a new terminal window to evade detection and sent stolen data, including IP addresses, to external servers. Another large-scale campaign, dubbed 'PhantomRaven,' involved 126 npm packages and over 86,000 downloads, targeting authentication tokens, CI/CD secrets, and GitHub credentials. These packages leveraged remote dynamic dependencies to fetch and execute payloads during installation, profiling infected devices and exfiltrating secrets for potential supply chain attacks. The attackers employed techniques such as slopsquatting, where AI-generated package recommendations led developers to install non-existent, malicious packages. Some packages impersonated tools from GitLab and Apache, and many remained available on npm at the time of reporting. The campaigns highlight the ongoing risks in the npm ecosystem, with attackers exploiting both user trust and platform weaknesses to compromise developer environments and CI/CD pipelines. Security experts warn that the theft of tokens and credentials could enable further attacks, including the introduction of malicious code into legitimate projects and broader supply chain compromises.
Jun 29, 2026
Researchers disclosed multiple software supply chain attacks that abused trusted package and plugin distribution paths to steal secrets and execute attacker code. SlowMist detailed the **TrapDoor** operation, which spread through more than 34 malicious packages and 384 versions across **npm**, **PyPI**, and **Crates.io**, using `postinstall` hooks, Python import-time execution, and Rust `build.rs` scripts to harvest credentials, cloud secrets, browser data, and cryptocurrency wallet files. The npm branch added encrypted exfiltration, arbitrary command execution, Git hook injection, shell persistence, and poisoning of AI-assistant context files such as `.cursorrules` and `CLAUDE.md`, while infrastructure on GitHub Pages, `raw.githubusercontent.com`, `api.github.com`, and `webhook.site` helped the traffic blend into normal developer activity. A separate SlowMist investigation found that legitimate npm package **node-ipc** was compromised through malicious releases `9.1.6`, `9.2.3`, and `12.0.1`, which appended obfuscated code to `node-ipc.cjs` and exfiltrated AWS credentials, SSH keys, environment variables, and host data over fragmented DNS queries after applications loaded the package with `require("node-ipc")`. In parallel, ToolJet disclosed a critical **instance-wide remote code execution** flaw in **ToolJet 3.x** that let any authenticated builder overwrite a globally shared marketplace plugin with attacker-controlled JavaScript, causing server-side execution whenever other users ran queries through the poisoned plugin; the advisory cited weak authorization, shared plugin records, unsafe `vm.runInNewContext()` exposure of `require` and `process`, and missing integrity checks for plugin code fetched from GitHub.
Jun 29, 2026