jscrambler's npm Package Was Trojanized for Three Hours — and the Infostealer Was Built to Steal Your AI Agent's Keys Too

Three Hours, Five Releases, One Compromised Account

On July 11, 2026, jscrambler 8.14.0 landed on npm carrying a malicious preinstall hook that drops and runs a platform-specific native binary — separate builds for Windows, macOS, and Linux — the moment the package installs. The release went out through the project's own legitimate maintainer account rather than a typosquat or a fork, which points to a compromised npm account or CI/build pipeline rather than a supply-chain trick aimed at fooling developers into picking the wrong package. Over the following three hours the attacker pushed four more malicious releases — 8.16.0, 8.17.0, 8.18.0, and 8.20.0 — interleaved with clean versions the maintainers appear to have shipped as remediation attempts in real time.

Caught by an AI Release Analyzer Before a Human Filed an Advisory

StepSecurity's automated release analyzer flagged 8.14.0 with a suspicion score of 0 — its maximum rating — within moments of the version publishing to the registry. Socket's follow-up analysis then confirmed what the automated flag had caught: the dropped binary is a Rust infostealer, compiled separately for all three major operating systems. That automated detection outpaced the usual disclosure path of a researcher filing a GitHub advisory or a CVE days later, and it's a preview of how supply-chain monitoring for a package used inside AI-assisted build pipelines is starting to work.

No Import, No CLI Call — Installing It Is Enough

The malicious code fires from the preinstall hook, before any application code, build script, or import statement runs. That means a developer or a CI job doesn't need to call jscrambler's obfuscation API or run its CLI to get compromised — running `npm install` with 8.14.0 (or any of the four releases that followed it) pinned or resolved is sufficient. The Rust binary then sweeps the host for secrets and ships them to a drop server over TLS, giving the attacker a working credential dump with essentially no interaction required from the victim.

The Line in the Remediation Guidance Aimed Squarely at AI Engineering Teams

Standard advice after a credential-stealing supply-chain hit is to rotate cloud keys and revoke Git tokens. This one's guidance goes further: rotate AI-tool and MCP API keys too, alongside npm and GitHub tokens, browser sessions, Discord and Slack logins, and Bitwarden vaults. That's a direct acknowledgment that developer machines and CI runners now routinely hold live Anthropic, OpenAI, and MCP server credentials in the same places they hold cloud deploy keys — and a generic infostealer sweep grabs all of it in one pass, with no distinction between a database password and the token guarding an internal MCP tool server.

60,000 Downloads a Month, Widest Blast Radius on CI Runners

jscrambler is a code-obfuscation and app-protection tool, which means its normal home isn't a single developer's laptop — it's a build step wired into CI pipelines that already hold deploy credentials, secrets-manager access, and signing keys for production releases. A package that fires malware on install rather than on use turns every CI runner that resolved one of the five bad versions into a potential credential leak, even if no human ever manually ran the tool.

What to Check This Week

Move to 8.15.0 or pin back to 8.13.0, the last confirmed-clean release before the incident, and purge 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0 from lockfiles, node_modules caches, and any CI cache layers that might have resolved them. If any of those versions executed anywhere — laptop or CI runner — treat every secret reachable from that machine as stolen, not just exposed: rotate cloud keys, npm and GitHub tokens, and AI-tool and MCP API keys, revoke Discord, Slack, browser, and Bitwarden sessions, and move any crypto off wallets that were present on the host.

Bottom Line

This is the third supply-chain incident to hit developer tooling in six weeks, after the poisoned Claude Code GitHub Action and the GuardFall shell-injection flaw — and the pattern connecting them isn't the attack vector, it's the target. Infostealer payloads no longer stop at cloud and Git credentials; the remediation checklist now explicitly includes the keys guarding coding agents and MCP servers, because those tokens sit on the same disk and unlock the same production systems. Teams that treat AI-tool and MCP credentials as a separate, lower-priority category from cloud secrets have a concrete reason to fold them into the same rotation and detection playbook, because attackers already have.