Poisoned Developer Tool Downloaded Nearly 1,500 Times Before Anyone Noticed

Key points

• Criminals used stolen login credentials to push malicious versions of the Jscrambler NPM package starting 11 July 2026.
• The tainted versions (8.16, 8.17, 8.18, and 8.20) were downloaded 1,479 times before Jscrambler pulled them.
• Four related packages were also affected, including Jscrambler-webpack-plugin 8.6.2, gulp-Jscrambler 8.6.2, grunt-Jscrambler 8.5.2, and Jscrambler-metro-plugin 9.0.2.
• The hidden malware targeted saved passwords, cryptocurrency wallets, AI coding tools, and cloud access keys on developers' machines.
• Version 8.22 is the first confirmed clean release; anything between 8.16 and 8.20 should be removed immediately.

A weekend is a bad time to be the person on call. That's exactly what Jscrambler discovered on 11 July 2026, when criminals used a stolen NPM publishing credential to quietly release a booby-trapped version of the company's popular developer package. NPM is a giant online library where developers download ready-made code building blocks. Jscrambler's package sits inside a product called Jscrambler Code Integrity, which helps businesses protect their web and mobile apps from tampering.

The attackers didn't break through a firewall or exploit a software bug. They logged in with a valid username and password, then uploaded their own doctored version of the package. It looked legitimate and installed without complaint.

What does the malware actually do?

Once installed, the poisoned package triggered a preinstall hook that dropped a hidden binary written in Rust, a compiled language chosen here for how cleanly it runs across operating systems. That binary went hunting: saved browser passwords, cryptocurrency wallet seed phrases, login tokens for cloud services, AI coding assistant configurations, messaging app data, and gaming platform sessions. Everything it collected was sent out over an encrypted TLS connection, which meant most network security tools wouldn't flag the traffic. The malware also attempted privilege escalation and persistence, and ran reconnaissance on the host.

While Jscrambler was responding, the attacker published three more malicious versions: 8.16, 8.17, 8.18, and eventually 8.20. Across all four, the packages were downloaded 1,479 times. Four dependent packages automatically pulled in the same bad code.

We've been following this incident closely: our story on 13 July covered the initial takedown, and our 11 July report noted that version 8.14.0 fired its payload the moment a developer ran install, before a single line of their own code ran.

Jscrambler has since revoked all affected credentials, rotated relevant secrets, and tightened controls around its publishing pipeline. Version 8.22 is clean.

Should you worry about this kind of attack?

This is a supply-chain attack: criminals didn't target end users directly. They poisoned a tool developers trust and let the install process do the rest. It sidesteps most conventional defences. MFA (multi-factor authentication, where logging in requires a second step beyond a password) would almost certainly have blocked this. One stolen credential isn't enough when a second confirmation is required. Worth watching: npm 12 now ships with auto-run install scripts disabled by default, which would have stopped this payload firing at all.

If you installed Jscrambler between 11 July and 8.22: remove anything from 8.16 to 8.20, scan for malware, and rotate every credential and cloud token on that machine. Treat anything those systems could reach as potentially seen.