jscrambler npm hijack sweeps AI coding tool config keys
TL;DR
- Socket detected version 8.14.0 within six minutes, but the attacker published four more malicious versions in three hours to retake `latest`.
- By version 8.18.0 the attacker abandoned preinstall hooks for require()-time injection into dist/index.js, defeating the standard --ignore-scripts defense.
- jscrambler, a JavaScript obfuscation vendor, became the attack vector itself, giving malicious versions immediate trust across developer build pipelines.
The interesting bit in this week's npm supply chain attack isn't the mechanics, which are familiar by now. It's the target list. According to The Hacker News, a compromised version of the jscrambler package started shipping a cross-platform Rust infostealer on July 11, 2026 that, alongside the usual cloud credentials and crypto wallets, went hunting through config files for Claude Desktop, Cursor, Windsurf, VS Code and Zed, including Model Context Protocol credentials.
The version history is worth reading closely. Five releases were tagged as malicious: 8.14.0, 8.16.0, 8.17.0, 8.18.0 and 8.20.0, with a clean 8.15.0 in between and 8.22.0 as the confirmed clean upgrade. The first releases used a standard preinstall hook. Later versions moved the dropper into the main package code, the kind of change that quietly defeats developers relying on install-script blocking as their mitigation. Socket reportedly flagged the initial release six minutes after publication, and jscrambler has said the root cause was a compromised npm publishing credential.
Why this matters if you don't ship jscrambler is that your AI coding assistant's config file is now a first-class target. Anthropic keys, MCP endpoints and whatever tokens your Cursor or Windsurf setup has cached to make agentic workflows feel seamless are, on most machines, sitting in a predictable path in lightly protected JSON. A weekly download count of about 15,800 gives you a rough sense of the exposed base for this one package, but the pattern will generalize to every registry and every AI dev tool that stores keys the same way.
What the reporting doesn't give you is a confirmed count of infected machines, where the stolen material was sent, or how the maintainer's npm credential was taken in the first place. Take the six-minute detection as encouraging on the defender side, not as a ceiling on damage. The forward-looking read is that AI dev tool vendors now have a clear reason to move API keys out of user-editable JSON and into the OS keychain, and that anyone shipping an MCP server should assume the credential store on the other end is being scraped.
What others are reporting
-
Socket Research Read →
First-party detection report from the firm that flagged the package 6 minutes post-publication; includes ChaCha20-Poly1305 string decryption, binary offsets, and full attacker evasion timeline.
Undocumented `preinstall` hook executes code automatically during `npm install`.
-
SafeDep Read →
Deepest technical source: documents custom binary container format, hook-to-require()-injection migration across versions, C2 RAT protocol, compiler fingerprints, and embedded persistence templates.
The attacker republished with the same payload and hook, taking back `latest`.
-
Defend Network Read →
Frames CI and build-system exposure: any automated pipeline installing this version executes the malware with no user interaction required.
The hook drops and runs a native binary infostealer compiled separately for Windows, macOS, and Linux.
-
Mallory Read →
Highlights durable persistence via Windows scheduled tasks and macOS LaunchAgents, and flags ongoing npm risk from version 8.14.0 still available for pinned installs.
Reported targets included cloud credentials, browser data, messaging sessions, cryptocurrency wallets, and configuration files for AI coding tools.
Originally reported by thehackernews.com
Read the original article →Original headline: Compromised jscrambler npm 8.14.0 Release Drops Rust Infostealer Targeting Claude Desktop, Cursor, Windsurf, VS Code and Zed Config Files