Several Jscrambler npm package versions were maliciously updated to install credential-stealing malware on Windows, macOS, and Linux systems used by developers and cloud operators. Jscrambler said an attacker used stolen or otherwise compromised npm publishing credentials starting July 11, 2026 to publish poisoned versions 8.16, 8.17, 8.18, and 8.20 of the main package; the first clean version is 8.22. Related packages were also affected through dependency chains, including Jscrambler-webpack-plugin 8.6.2, gulp-jscrambler 8.6.2, grunt-jscrambler 8.5.2, and Jscrambler-metro-plugin 9.0.2, with 1,479 downloads recorded before deprecation.
Why it matters: Anyone who installed the affected packages may have had passwords, tokens, cloud credentials, crypto-wallet data, and other secrets stolen. Organizations using these packages should remove the affected versions immediately, scan impacted machines, and rotate credentials and API keys without delay.
Ionut Arghire
2026.07.14
100% relevant
This article establishes a distinct supply-chain compromise centered on Jscrambler's npm publishing account and poisoned package releases, not a follow-up to an existing tracked event.
← Back to all stories