Does npm install --ignore-scripts protect against this attack?
Only partially. Early versions (8.14.0–8.17.0) ran through a preinstall hook that --ignore-scripts blocks entirely. Later versions (8.18.0, 8.20.0) moved the same payload into dist/index.js and dist/bin/jscrambler.js as self-executing functions, which run automatically on import or CLI use regardless of that flag being set.
Answered in
Malware Hid Inside a Popular Obfuscation Tool — and Went Hunting for Your AI Coding Agent's CredentialsStolen npm credentials let attackers slip native-binary malware into jscrambler, hunting for Claude Desktop, Cursor, and Windsurf credentials.
Read the full analysisOther questions this article answers
More development best practices questions
- How many outage reports did Claude and ChatGPT get on July 14, 2026?
- What did Anthropic's own status page say about the July 14 Claude outage?
- Did Claude have more outages after July 14?
- What did ChatGPT's status checker say was wrong?
- Is this outage pattern actually unusual for AI providers?
- What GitHub Actions vulnerability did the attacker exploit?
- How many npm packages were compromised, and how widely were they used?
- What did the malicious payload actually do?
Every answer on Crashtech is written by the editor of the article it comes from — never auto-summarised. Browse all answers or the Development Best Practices beat.