12 July 2026 - 07:32
Category: Trust Issues
Security tools stealing your data again
The official jscrambler npm package 8.14.0 was trojanized, kindly dropping an infostealer on developer environments. I suppose protecting code was getting a bit too tedious anyway.
Source: SafeDep
The Full Story
Because life in IT is a joke, developers using jscrambler npm on Windows, Linux, or macOS got a trojanized version 8.14.0 that steals assets instead of protecting code. This overachieving malware eagerly sweeps dev setups for AWS, Azure, Google Cloud credentials, crypto wallets, and password manager data. To survive this latest supply-chain betrayal, we must somehow avoid this version and stop its malicious preinstall Rust binaries. It is just another exhausting day of watching security tools do the threat actors' jobs for them.