Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install

A malicious version (8.14.0) of the jscrambler npm package was published with a preinstall hook that drops a cross-platform Rust infostealer. The payload targets developers by stealing cloud credentials, cryptocurrency wallets, password manager data, and API keys from AI coding tools. It establishes persistence and communicates with attacker-controlled infrastructure, including hard-coded IP addresses and Tor. The compromised version remains on npm, posing ongoing risk to systems using outdated clients that automatically execute install scripts.

AI-extracted · verify before operational use