Multiple Jscrambler Packages Impacted by Supply Chain Attack

By Ionut Arghire

AI Summary

A supply chain attack compromised multiple Jscrambler NPM package versions, injecting a cross-platform credential stealer into a widely used JavaScript obfuscation tool. Jscrambler is deployed in enterprise web application build pipelines, meaning the poisoned packages could have harvested developer and CI/CD credentials at scale. Security teams using Jscrambler should audit their dependency versions and rotate any credentials exposed in affected build environments.

Read full article → https://www.securityweek.com/multiple-jscrambler-p…

Relevance score: 77.0/100

# More from July 15

1
Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack The Hacker News
2
SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now BleepingComputer
3
11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot The Hacker News
4
SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data The Hacker News
5
OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials The Hacker News
6
Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths The Hacker News
7
Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown BleepingComputer
8
U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support The Hacker News
9
US unseals indictment against alleged operators of Russian bulletproof hosting service The Record