Poisoned Developer Tool Downloaded Nearly 1,500 Times Before Anyone Noticed

Key points

• Criminals used stolen login credentials to push malicious versions of the Jscrambler NPM package starting 11 July 2025.
• The tainted versions (8.16, 8.17, 8.18, and 8.20) were downloaded 1,479 times before Jscrambler pulled them.
• Four related packages were also affected, including Jscrambler-webpack-plugin version 8.6.2 and gulp-Jscrambler version 8.6.2.
• The hidden malware targeted saved passwords, cryptocurrency wallets, AI coding tools, and cloud access keys on developers' machines.
• Version 8.22 is the first confirmed clean release; anything between 8.16 and 8.20 should be removed immediately.

A weekend is a bad time to be the person on call. That is exactly what Jscrambler discovered on 11 July 2025, when criminals used a stolen NPM publishing credential to quietly release a booby-trapped version of the company's popular developer package.

NPM is a giant online library where software developers download ready-made code building blocks. Jscrambler's package sits inside a product called Jscrambler Code Integrity, which helps businesses protect their web and mobile apps from tampering. A lot of developers rely on it, which made it an attractive target.

The attackers did not break through a firewall or exploit a software bug. They simply logged in with a valid username and password that they had obtained somehow, then uploaded their own doctored version of the package. It looked legitimate. It installed without complaint.

What does the malware actually do?

Once a developer installed the poisoned package, it quietly ran a hidden program written in the Rust programming language. Rust is a modern coding language often favoured for performance, and it helped the malware run cleanly on Windows, macOS, and Linux computers alike.

That program then went hunting. It looked for saved browser passwords, cryptocurrency wallet keys and their recovery phrases (called seed phrases), login tokens for cloud services like AWS or Azure, settings for AI coding assistants, messaging app data, and gaming platform sessions. It packaged everything it found and sent it out over an encrypted connection so network security tools would not flag the traffic.

While Jscrambler was working to remove the first bad version, the criminals uploaded three more: 8.16, 8.17, 8.18, and eventually 8.20. In total, across all four releases, the malicious packages were downloaded 1,479 times. Four related packages pulled in the same bad code automatically because they depended on the main one.

Jscrambler has since revoked all affected credentials, rotated passwords and secrets, and tightened controls around how new package versions get published. Version 8.22 is clean.

This is a supply-chain attack, meaning the criminals did not target end users directly. They poisoned a tool that developers trust, and let the developers do the rest. It is a technique that sidesteps most conventional defences.

MFA, meaning multi-factor authentication (where logging in requires a second confirmation step beyond a password, such as a code sent to your phone), would almost certainly have blocked the initial access here. One stolen credential would not have been enough.

If you are a developer who installed Jscrambler between 11 July and the release of 8.22: remove any version from 8.16 to 8.20 immediately, scan your machine for malware, and rotate every password, API key, and cloud access token on that system. Treat anything those machines could reach as potentially seen by a stranger.