#jscrambler

· 3mo ago

#JScrambler shares a transparent postmortem on how attackers used a stolen #npm publishing token to ship #malware via its official npm package. A must-read for anyone serious about software supply chain security: #SoftwareSupplyChainSecurity 👇

jscrambler.com

Security Incident Postmortem

July 11, 2026: an attacker used a stolen npm token to publish malicious versions of the Jscrambler package. We caught the security incident.

The New Oil @thenewoil@mastodon.thenewoil.org

· 3mo ago

Hackers backdoor #Jscrambler #npm package with #infostealer #malware https://www.bleepingcomputer.com/news/security/hackers-backdoor-jscrambler-npm-package-with-infostealer-malware/ #cybersecurity

bleepingcomputer.com

Hackers backdoor Jscrambler npm package with infostealer malware

The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm package that has been downloaded almost 1,500 times.

Sam Stepanyan

🐘 @securestep9@infosec.exchange

· 3mo ago

#NPM: A compromised release of the popular #JScrambler npm package introduced hidden #malware binaries that execute automatically during npm install, exposing users to a supply chain attack before any application code runs: #SoftwareSupplyChainSecurity 👇

jscrambler npm Package Compromised in Supply Chain Attack

socket.dev

jscrambler npm Package Compromised in Supply Chain Attack

A compromised jscrambler npm release added a malicious preinstall hook that runs hidden native binaries on Linux, macOS, and Windows.

You've seen all posts