Jscrambler npm Package Compromised, Drops Rust Infostealer

Version 8.14.0 of the jscrambler npm package included a malicious preinstall hook that silently installs a Rust-based infostealer on Windows, macOS, and Linux. The attack requires no import or CLI call—simply installing the package triggers the malware. Socket detected the malicious release within six minutes of its publication on July 11, 2026.