Multiple Jscrambler Packages Impacted by Supply Chain Attack
A supply chain attack targeting Jscrambler’s NPM package led to the distribution of malicious versions containing malware designed to steal sensitive information from developer and cloud environments. The attack exploited compromised NPM credentials to deliver a sophisticated payload capable of harvesting credentials, secrets, and reconnaissance data.
A supply chain attack targeting Jscrambler’s NPM package resulted in the distribution of malicious versions of the JavaScript protection solution, Jscrambler Code Integrity. The attack began on July 11th when a threat actor leveraged compromised NPM publishing credentials to upload modified package versions. These malicious packages included a preinstall hook that triggered the infection chain upon installation, executing setup.js and intro.js to drop platform-specific binaries.
These binaries, written in Rust, are information stealers designed to target a wide range of sensitive data, including developer and cloud-operator machine credentials, cryptocurrency wallets and seed phrases, AI coding assistant configurations, OS keyrings, and more. The malware also attempts to elevate privileges and perform host reconnaissance, exfiltrating harvested information over TLS via rustls to a drop server and constructing requests to query cloud and orchestration APIs using stolen credentials.
The attack affected other packages dependent on Jscrambler’s NPM library, including Jscrambler-webpack-plugin version 8.6.2, gulp-Jscrambler version 8.6.2, grunt-Jscrambler version 8.5.2, and Jscrambler-metro-plugin version 9.0.2. According to Jscrambler, the malicious packages were downloaded 1,479 times before being deprecated and replaced with clean versions.
Jscrambler has revoked and rotated all relevant credentials and implemented additional security controls. Socket, a supply chain security firm, observed the malware exfiltrating harvested information over TLS via rustls, likely to a drop server. The attack highlights the risks associated with compromised NPM credentials and the potential for attackers to inject malicious code into widely used dependencies.
Users are advised to immediately remove the affected Jscrambler NPM package versions from their machines, scan their systems for malware, and rotate all credentials, tokens, and API keys.