Installing One Popular npm Package Was Enough to Run an Infostealer

The jscrambler package on npm was compromised so that merely installing its 8.14.0 release, published on July 11, ran an infostealer on the developer's machine, as reported by The Hacker News. A preinstall hook dropped and executed a Rust-based stealer during installation.

This is the install-script attack in its purest form. The victim did not have to import the package, call it, or run their application. The malicious code fired the moment npm processed the install, which is what makes a poisoned dependency so effective and so quiet.

The timing is almost on the nose. It lands just as npm shipped version 12 with install scripts disabled by default, a change aimed at exactly this class of compromise. The jscrambler case is a live demonstration of why that default needed to change, and a reminder that the ecosystem is still full of installs configured the old way.

The immediate steps for anyone who pulled the bad version are to treat the machine as compromised: rotate any credentials and tokens that were present, remove the malicious version, pin to a known-good release, and audit continuous integration systems that may have installed it automatically. On a shared build server, one poisoned install can reach a lot further than one laptop.

Sources: The Hacker News.