What is the jscrambler npm supply chain attack?
On July 11, 2026, attackers used a stolen npm publishing credential to push five malicious jscrambler releases over roughly three hours — 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0 — plus four compromised companion plugins. Each shipped hidden native binaries that harvested cloud, crypto-wallet, and AI coding assistant credentials, according to Rescana and Socket.
Answered in
Malware Hid Inside a Popular Obfuscation Tool — and Went Hunting for Your AI Coding Agent's CredentialsStolen npm credentials let attackers slip native-binary malware into jscrambler, hunting for Claude Desktop, Cursor, and Windsurf credentials.
Read the full analysisOther questions this article answers
More development best practices questions
- What did OpenAI’s Habitat team change?
- Does the reported 12× read improvement mean another team should copy the design?
- Does the Python Typing Survey measure all Python developers?
- Do Python type hints enforce types at runtime?
- What is interactive refactoring in gopls?
- Is interactive refactoring already part of the official LSP standard?
- What does Meta mean by human-on-the-loop software engineering?
- Does Meta's Forum project prove that AI can replace a software team?
Every answer on Crashtech is written by the editor of the article it comes from — never auto-summarised. Browse all answers or the Development Best Practices beat.