Our takeJscrambler NPM packages were poisoned in a supply chain attack to drop a credential stealer. Audit your dependencies and update to a clean version if you use them.Cyber Resilience desk
Sources (2)
- securityweek · securityweek
- hackernews · hackernews
What this means for you — Security leader:Audit all internal and third-party use of Jscrambler NPM packages; check package-lock.json and CI pipelines for versions published between the poisoned window and revert to known-good releases.
What this means for you — Lean IT orgs:If your team uses any Jscrambler JavaScript obfuscation packages from npm, stop and switch to a clean version right away; most small teams can simply run npm update or replace the package.
What this means for you — MSP:Scan client environments and build pipelines for any Jscrambler NPM packages; replace any versions published in the attack window and advise clients to rebuild affected applications.
What this means for you — Researcher:Review the malicious package versions, indicators, and credential-stealer payload; add the IoCs to detection rules and monitor for related supply-chain activity.