jscrambler npm Package Trojanized Across Five Malicious Releases — Rust Infostealer Targets CI/CD Secrets, Cloud Keys, and Crypto Wallets

On July 11, the official jscrambler npm CLI (a commercial JavaScript obfuscation tool with ~15,800 weekly downloads) was compromised via a hijacked maintainer account or build pipeline, with the attacker publishing five malicious versions (8.14.0 through 8.20.0) over approximately three hours. Each release included a preinstall hook that silently dropped and executed a cross-platform Rust infostealer targeting AWS/Azure/GCP cloud credentials, cryptocurrency wallets (MetaMask, Phantom, Exodus), Bitwarden vault contents, and browser session data — all before a single line of project code ran. Socket flagged the initial release six minutes after publication; any CI/CD pipeline that ran npm install in that window should be treated as fully compromised and all reachable secrets rotated immediately.

Socket flagged the initial release six minutes after publication; any CI/CD pipeline that ran npm install in that window should be treated as fully compromised and all reachable secrets rotated immediately.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.