Developers who installed jscrambler version 8.14.0 (and several subsequent versions) between July 10 and July 11, 2026 may have had sensitive credentials stolen. Attackers compromised the package’s npm account or build pipeline and pushed a malicious release containing a hidden Rust program that runs automatically during installation. The malware targeted a wide range of valuable credentials: cloud API keys for AWS, Azure, and Google Cloud; cryptocurrency wallets and seed phrases from MetaMask, Phantom, and Exodus; browser passwords and saved sessions; Discord and Slack tokens; and config files for AI coding tools including Claude Desktop, Cursor, Windsurf, VS Code, and Zed — where API keys tend to accumulate. Security researchers at Socket detected the malicious package within six minutes of publication, but the window was enough to reach roughly 15,800 weekly downloaders.
The compromised versions are 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0. The package’s developers have released a clean replacement at version 8.22.0 (or you can roll back to 8.13.0). If your project’s build system or CI/CD pipeline ran npm install during this window, treat the machine as potentially compromised.
How to check if you’re affected
Affected versions include 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0 of the jscrambler npm package. To check:
- Run
npm list jscramblerin your project — if you see any of those versions, act immediately. - Update to 8.22.0 (or revert to 8.13.0).
- Rotate all credentials on machines that installed the affected versions: cloud access keys (AWS, Azure, GCP), npm and GitHub tokens, AI tool API keys, cryptocurrency seed phrases, and browser-saved passwords.
- Revoke active sessions in Discord and Slack, then log back in.
- Block the known command-and-control IP addresses at your firewall:
37.27.122.124and57.128.246.79.