Executive Summary
On July 11, 2026, the popular JavaScript protection tool `jscrambler` was compromised via unauthorized access to an npm publishing credential. The attacker published several malicious versions (8.14.0 through 8.20.0) that deliver platform-specific native binaries for Windows, Linux, and macOS. These payloads are designed to execute automatically during `npm install` or upon importing the package, facilitating immediate infection of developer workstations and build servers without requiring application execution.
The technical analysis reveals a highly sophisticated Rust-based infostealer embedded within an obfuscated "CSI" container. The malware employs advanced evasion techniques, including per-string ChaCha20-Poly1305 encryption for over 2,400 configuration strings and transition from install hooks to self-executing functions to bypass script-ignoring installation flags. The broad targeting includes AI coding assistants, cloud provider metadata (AWS, GCP, Azure), cryptocurrency wallets, and messaging applications.
This campaign represents a critical risk to software supply chains, as affected environments likely suffered exposure of sensitive source code, deployment tokens, and infrastructure credentials. Organizations using Jscrambler must immediately audit their build logs, rotate all potentially exposed secrets, and upgrade to the verified clean version 8.22.0.