DevThe Hacker Newsabout 2 hours ago
Jscrambler npm Package Drops Rust Infostealer
1 min read
Version 8.14.0 of the jscrambler npm package shipped with a malicious preinstall hook that drops a Rust infostealer during installation on Windows, macOS, and Linux. Socket flagged the release six minutes after it was published on July 11, 2026. The payload steals cloud credentials, crypto wallets, browser passwords, and AI tool configs.
Level
Hype check
Tap to vote and see what everyone thinks.
