A severe software supply chain attack has compromised the widely used jscrambler utility package on the npm registry, with the malicious 8.14.0 release dropping a native Rust infostealer on developer machines during package installation. Pushed straight to the registry using a compromised publisher credential, the update bypassed the project’s public GitHub release flow. The compromised package includes a preinstall hook that extracts and executes compressed binaries tailored for Windows, macOS, and Linux platforms.
The dropped payload is an advanced Rust-based infostealer that aggressively sweeps compromised developer machines for sensitive access parameters. It targets cloud credentials for Amazon Web Services, Microsoft Azure, and Google Cloud, including the metadata endpoints utilized by continuous integration runners. It also harvests browser-stored passwords, multi-factor authentication configurations, and cryptocurrency private keys from MetaMask, Phantom, and Exodus.
Subverting a developer’s local environment or build pipeline exposes the entire corporate network to secondary intrusion loops. Since continuous integration nodes and developer systems routinely maintain persistent write tokens to code repositories and cloud registries, a local credentials leak allows attackers to silently inject backdoors into production codebases and bypass automated controls.
– Check local build systems and developer workstations to verify that jscrambler version 8.14.0 was not pulled or executed.
– Force-downgrade any installations of the package to the secure 8.13.0 release tier immediately.
– Rotate all cloud access keys, repository access tokens, and passwords used on any system exposed to the compromised version.
– Enforce strict repository policies that prevent the automated execution of third-party package preinstall scripts.
Software supply chain integrity demands that developers strictly restrict package installation hooks and verify dependency origins to guarantee that development nodes are completely shielded from automated credential harvesting scripts. #CodeDefence #SupplyChain #npm #Jscrambler #InfoStealer #DevSecOps
/
