Hacker backdoor Jscrambler npm package and infostealer malware

Consumer-side net safety firm Jscrambler revealed that attackers printed a malicious model of their npm package deal, which was downloaded roughly 1,500 occasions.

The malicious Jscrambler packages spanned releases 8.14, 8.16, 8.17, and eight.20 and contained information-stealing malware that was executed throughout the “preinstallation” hook.

“At the moment, we confirmed {that a} malicious model of the jscrambler npm package deal utilized in our Code Integrity merchandise has been fraudulently printed,” Jscrambler mentioned in an alert on Saturday.

“This incident was restricted to that package deal and didn’t have an effect on different Jscrambler merchandise, together with Webpage Integrity,” the corporate mentioned.

Jscrambler responded rapidly, however the malicious package deal endured for 2 hours till the developer deprecated it and launched a safe model, 8.22.

The affected package deal was a dependency of 4 different Jscrambler packages, which the seller additionally deprecated and changed with newer variations.

Node Bundle Supervisor (npm) statistics present that the malicious package deal was downloaded 1,479 occasions in a two-hour interval.

Jscrambler is a business platform that protects net and cell JavaScript functions from reverse engineering and tampering.

Its npm package deal is downloaded 17,000 occasions every week and permits app builders to add their JavaScript to Jscrambler’s service to guard their code from tampering. This helps stop real-time adjustments equivalent to malicious code injection.

Software safety firm Socket detected the breach and analyzed the unauthorized Jscrambler launch. Researchers mentioned the package deal contained info theft instruments that focused a number of kinds of delicate information.

• Supply code and venture information
• Developer credentials and secrets and techniques (Git, SSH, setting variables, CI/CD tokens)
• Cloud credentials and secrets and techniques supervisor (AWS, Azure, GCP, Kubernetes)
• AI coding instruments and MCP configurations (Claude, Cursor, Windsurf, VS Code, Zed)
• Cryptocurrency wallets and seed phrases (MetaMask, Phantom, Coinbase, Exodus, Belief Pockets)
• Browser information (cookies, saved credentials)
• Messaging and collaboration apps (Slack, Discord, Telegram)

Socket reported that the malware used sturdy string-by-string obfuscation with the ChaCha20-Poly1305 encryption algorithm, which made the code troublesome to reverse engineer.

In response to Jscrambler, the breach was made potential as a result of npm public credentials have been compromised, however the firm has revoked the credentials.

On account of this incident, extra safety controls have been carried out within the publishing pipeline.

Builders with malicious npm packages ought to deal with their setting as compromised, rotate all secrets and techniques, and restore from safe backups.

Jscrambler recommends that clients make sure that they’re utilizing the most recent model of the product.