> TritonInfoSec News
Home / Jul 12, 2026 / Story
0
#1 The Hacker News general July 11, 2026 at 17:59 UTC

Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install

By [email protected] (The Hacker News)

AI Summary

The jscrambler npm package version 8.14.0, published July 11, 2026, was found to contain a malicious preinstall hook that silently executes a Rust-based infostealer during installation across Windows, macOS, and Linux — requiring no import or CLI invocation. Socket detected the compromise just six minutes after publication. Supply chain attacks via trusted npm packages pose severe risk to CI/CD pipelines and developer environments.

Read full article → https://thehackernews.com/2026/07/compromised-jscr…

Relevance score: 82.0/100

# More from July 12

  1. 2
    New U-Boot flaws could enable stealthy firmware attacks BleepingComputer
  2. 3
    Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages The Hacker News
  3. 4
    Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions The Hacker News
  4. 5
    ‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism SecurityWeek
  5. 6
    'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets BleepingComputer
  6. 7
    Former ransomware negotiator gets 4 years for BlackCat attacks BleepingComputer
  7. 8
    Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers The Hacker News
  8. 9
    Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched The Hacker News
  9. 10
    Network of 200 GitHub Repositories Used for Malware Infection SecurityWeek