Jscrambler npm releases dropped a Rust infostealer

Attackers used a stolen npm publishing credential on July 11, 2026 to release five malicious versions of jscrambler, the client-side code protection tool, along with poisoned releases of its webpack, gulp, grunt, and Metro plugins. The first bad version went out at 16:12:40 BST and security vendors flagged it within minutes.

Jscrambler sells JavaScript obfuscation and integrity protection, and its npm package is wired into build pipelines, which is precisely where the payload wanted to be. The malicious releases were jscrambler 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0, plus jscrambler-webpack-plugin@8.6.2, gulp-jscrambler@8.6.2, grunt-jscrambler@8.5.2, and jscrambler-metro-plugin@9.0.2. Each dropped and executed a Rust infostealer on Windows, macOS, and Linux.

The interesting part is what changed mid-incident. The first releases used a preinstall hook, the ordinary approach. From 8.18.0 onward the attacker dropped the install hook entirely and moved the dropper into a self-executing function inside dist/index.js and the CLI binary. That defeats scanners that only inspect lifecycle scripts, and it renders npm install --ignore-scripts useless as a mitigation, since the code runs when the tool is used rather than when it is installed.

The collection profile reflected 2026 developer machines: cloud credentials, CI tokens, browser sessions, cryptocurrency wallets, Bitwarden vaults, and the configuration files of AI coding assistants including Claude Desktop and Cursor. The malicious releases were downloaded 1,479 times before Jscrambler deprecated them and published clean builds as 8.22.0, 8.6.3, 8.6.3, 8.5.3, and 9.0.3. In its own advisory the company described the incident as an unauthorized publication of a malicious npm package affecting CI.