Malicious Jscrambler npm package stole developer secrets for two hours before takedown

Key points

• Jscrambler confirmed on Saturday that a malicious version of its npm package (used by developers to protect JavaScript code) was published without authorisation.
• Versions 8.14, 8.16, 8.17 and 8.20 were live for two hours and downloaded 1,479 times before a clean version 8.22 replaced them.
• The hidden malware harvested source code, cloud keys, cryptocurrency wallet data and browser cookies, among other sensitive material.
• Attackers got in with stolen npm publishing credentials, which have now been revoked.
• Any developer who installed the tainted package should treat their machine as compromised and rotate every secret it touched.

Jscrambler, a company that sells tools to stop attackers tampering with JavaScript in websites and mobile apps, confirmed over the weekend that criminals published a booby-trapped version of its own software library.

The library sits on npm, the public repository where JavaScript developers download code building blocks. Jscrambler's package pulls in around 17,000 downloads a week. For roughly two hours on Saturday, the version listed there wasn't the real one.

What did the malicious package actually do?

It ran an information stealer the moment a developer installed it. The malware fired during the preinstall step, code that runs automatically before the package is even set up, meaning victims didn't need to do anything beyond typing npm install.

Application-security firm Socket, which spotted the compromise and pulled apart the code, says the stealer went after source code and project files, developer credentials including Git tokens, SSH keys and CI/CD secrets, cloud account keys for AWS and Kubernetes, configuration files from AI coding assistants including Claude and Cursor, cryptocurrency wallets and seed phrases from MetaMask, Phantom, Coinbase, Exodus and Trust Wallet, browser cookies and saved passwords, and data from Slack, Discord and Telegram.

Socket's researchers noted that each malicious string in the code was individually encrypted using ChaCha20-Poly1305, a strong encryption algorithm, which made the payload harder to spot and slower to analyse. We first covered Socket's work on this Jscrambler package on 11 July 2026 in our story on version 8.14.0, when that earlier release was found to carry the same install-time trigger.

The compromise was first reported by BleepingComputer.

How did the hackers get in?

Jscrambler says the attackers had valid npm publishing credentials. Someone got hold of the login details used to push new versions of the package to the public registry and used them to upload the poisoned build as if it were legitimate.

Those credentials have been revoked. The company says it's added extra controls to its publishing pipeline, though it hasn't detailed them publicly. Four other Jscrambler packages that depended on the affected library have also been deprecated and replaced.

"This incident was limited to that package and did not affect any other Jscrambler products, including Webpage Integrity," the company said in its notice.

What should affected developers do?

If you installed jscrambler versions 8.14, 8.16, 8.17 or 8.20 during that Saturday window, assume every secret on that machine is now in criminal hands. Rotate cloud access keys, invalidate active session cookies, move any crypto held in hot wallets to fresh addresses with new seed phrases, and regenerate CI/CD tokens. Restore affected workstations from a clean backup rather than trying to disinfect them, then upgrade to jscrambler 8.22 or later.

Should you worry about npm supply-chain attacks more broadly?

This attack fits a pattern that's been accelerating. A single stolen maintainer login can reach thousands of downstream developers in minutes, and Jscrambler's 17,000 weekly downloads made it a worthwhile target. This one was caught inside two hours. Not every one is, and the real damage from a credential haul like this won't be clear for weeks.