--- title: Hackers backdoor Jscrambler npm package with infostealer... description: Jscrambler disclosed that a threat actor published malicious versions of its npm package (8.14, 8.16, 8.17, 8.20), which were downloaded 1,479 times over a... canonical: https://daily.dev/posts/hackers-backdoor-jscrambler-npm-package-with-infostealer-malware-blf8gd33m twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers backdoor Jscrambler npm package with infostealer malware | daily.dev og:description: Jscrambler disclosed that a threat actor published malicious versions of its npm package (8.14, 8.16, 8.17, 8.20), which were downloaded 1,479 times over a... og:url: https://daily.dev/posts/hackers-backdoor-jscrambler-npm-package-with-infostealer-malware-blf8gd33m og:image: https://api.daily.dev/og/posts/bLf8gD33M.png og:image:alt: Hackers backdoor Jscrambler npm package with infostealer malware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers backdoor Jscrambler npm package with infostealer malware **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 2 upvotes · 0 comments ## Summary Jscrambler disclosed that a threat actor published malicious versions of its npm package (8.14, 8.16, 8.17, 8.20), which were downloaded 1,479 times over a two-hour window before being deprecated. The compromised package contained an infostealer that executed during the preinstall hook, targeting developer credentials, cloud secrets (AWS, Azure, GCP, Kubernetes), AI coding tool configs (Claude, Cursor, Windsurf), cryptocurrency wallets, browser data, and messaging apps. The attack was made possible by compromised npm publishing credentials. Socket detected and analyzed the malware, which used ChaCha20-Poly1305 encryption for obfuscation. Jscrambler has revoked the credentials, deprecated affected packages, released safe version 8.22, and added additional publishing pipeline controls. Developers who installed the malicious versions should treat their environments as compromised and rotate all secrets. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Was the Jscrambler npm package compromised with malware? Yes, a threat actor published a malicious version of the jscrambler npm package spanning releases 8.14, 8.16, 8.17, and 8.20, containing infostealer malware that executed during the preinstall hook. The compromise, caused by stolen npm publishing credentials, lasted about two hours and was downloaded 1,479 times before Jscrambler deprecated it and released clean version 8.22. _Teams tracking supply-chain compromises in their dependencies can follow incidents like this on daily.dev._ ### What data did the malicious Jscrambler npm package steal? The malware targeted source code and project files, developer credentials and secrets from Git, SSH, environment variables, and CI/CD tokens, cloud credentials for AWS, Azure, GCP, and Kubernetes, AI coding tool configs for Claude, Cursor, Windsurf, VS Code, and Zed, cryptocurrency wallets like MetaMask and Phantom, browser data, and Slack, Discord, and Telegram credentials. It used ChaCha20-Poly1305 encryption to obfuscate its code. _Developers auditing what a compromised dependency could expose can check breakdowns like this on daily.dev._ ### What should I do if I installed the compromised Jscrambler npm package? Treat the environment as compromised, rotate all secrets, and restore from safe backups. Jscrambler revoked the compromised publishing credentials responsible for the incident and added extra security controls to its publishing pipeline, and recommends customers update to the latest safe package version, 8.22. _Anyone responding to a supply-chain incident can find remediation steps like these on daily.dev._ ## Similar posts on daily.dev - [jscrambler npm Package Compromised in Supply Chain Attack](https://daily.dev/posts/jscrambler-npm-package-compromised-in-supply-chain-attack-qinps6h0j) · Socket · 0 upvotes · 0 comments - [jscrambler npm package publishes malicious preinstall binary](https://daily.dev/posts/jscrambler-npm-package-publishes-malicious-preinstall-binary-hv0avwili) · StepSecurity · 2 upvotes · 0 comments - [Popular node-ipc npm package compromised to steal credentials](https://daily.dev/posts/popular-node-ipc-npm-package-compromised-to-steal-credentials-41k0opnku) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/hackers-backdoor-jscrambler-npm-package-with-infostealer-malware-blf8gd33m) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers backdoor Jscrambler npm package with infostealer malware","url":"https://daily.dev/posts/hackers-backdoor-jscrambler-npm-package-with-infostealer-malware-blf8gd33m","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-backdoor-jscrambler-npm-package-with-infostealer-malware-blf8gd33m"},"datePublished":"2026-07-13T19:46:19.267Z","dateModified":"2026-09-13T19:39:21.724Z","description":"Jscrambler disclosed that a threat actor published malicious versions of its npm package (8.14, 8.16, 8.17, 8.20), which were downloaded 1,479 times over a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8403c2df51d75c56a59a65974a85e490?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8403c2df51d75c56a59a65974a85e490?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-backdoor-jscrambler-npm-package-with-infostealer-malware-blf8gd33m","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,npm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Hackers backdoor Jscrambler npm package with infostealer malware"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hackers-backdoor-jscrambler-npm-package-with-infostealer-malware-blf8gd33m#faq","mainEntity":[{"@type":"Question","name":"Was the Jscrambler npm package compromised with malware?","acceptedAnswer":{"@type":"Answer","text":"Yes, a threat actor published a malicious version of the jscrambler npm package spanning releases 8.14, 8.16, 8.17, and 8.20, containing infostealer malware that executed during the preinstall hook. The compromise, caused by stolen npm publishing credentials, lasted about two hours and was downloaded 1,479 times before Jscrambler deprecated it and released clean version 8.22. Teams tracking supply-chain compromises in their dependencies can follow incidents like this on daily.dev."}},{"@type":"Question","name":"What data did the malicious Jscrambler npm package steal?","acceptedAnswer":{"@type":"Answer","text":"The malware targeted source code and project files, developer credentials and secrets from Git, SSH, environment variables, and CI/CD tokens, cloud credentials for AWS, Azure, GCP, and Kubernetes, AI coding tool configs for Claude, Cursor, Windsurf, VS Code, and Zed, cryptocurrency wallets like MetaMask and Phantom, browser data, and Slack, Discord, and Telegram credentials. It used ChaCha20-Poly1305 encryption to obfuscate its code. Developers auditing what a compromised dependency could expose can check breakdowns like this on daily.dev."}},{"@type":"Question","name":"What should I do if I installed the compromised Jscrambler npm package?","acceptedAnswer":{"@type":"Answer","text":"Treat the environment as compromised, rotate all secrets, and restore from safe backups. Jscrambler revoked the compromised publishing credentials responsible for the incident and added extra security controls to its publishing pipeline, and recommends customers update to the latest safe package version, 8.22. Anyone responding to a supply-chain incident can find remediation steps like these on daily.dev."}}]} ```