jscrambler 8.14.0 on npm exposed a malicious preinstall hook and an infostealer for CI/CD

Colleagues, I want to draw attention to a cybersecurity incident: a malicious preinstall hook was found in the npm release of jscrambler 8.14.0.

This is a classic supply-chain attack: installing the package already triggers a Rust infostealer on Windows, macOS, and Linux.

It collects cloud keys, tokens, passwords, cookies, messenger sessions, and AI tool data.

If you may have installed 8.14.0, assume your secrets are compromised: review lockfiles, CI/CD logs, and rotate keys.

Why it matters: these attacks hit build environments directly and expose the most valuable data.

How do you currently vet npm dependencies in the supply chain?

#cybersecurity #npm #supplychain #devsecops