{
  "entry": {
    "kind": "vuln",
    "slug": "jscrambler-npm-package-hijacked-to-drop-ai-config-infostealer",
    "name": "jscrambler-npm-package-hijacked-to-drop-ai-config-infostealer",
    "vendor": "jscrambler",
    "description": "An attacker used a stolen credential to push malicious jscrambler npm versions carrying a cross-platform Rust infostealer via a preinstall hook. The malware specifically sweeps AI coding tool config files for Claude Desktop, Cursor, Windsurf, VS Code, and Zed, where API keys and MCP server credentials sit, alongside cloud keys and wallets.",
    "website": "https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "npm",
      "packageName": "jscrambler",
      "command": null
    },
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-07-11",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "jscrambler-npm-package-hijacked-to-drop-ai-config-infostealer",
      "aliases": [
        "ti-051"
      ],
      "title": "jscrambler npm Package Hijacked to Drop AI Config Infostealer",
      "summary": "An attacker used a stolen credential to push malicious jscrambler npm versions carrying a cross-platform Rust infostealer via a preinstall hook. The malware specifically sweeps AI coding tool config files for Claude Desktop, Cursor, Windsurf, VS Code, and Zed, where API keys and MCP server credentials sit, alongside cloud keys and wallets.",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise",
        "Credential theft"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "jscrambler",
        "vendor": null,
        "package": "jscrambler",
        "ecosystem": "npm",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "8.14.0 || 8.16.0 || 8.17.0 || 8.18.0 || 8.20.0",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-07-11",
      "modifiedAt": "2026-07-11",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html"
        }
      ],
      "mitigation": "Move off jscrambler 8.14.0 through 8.20.0 to 8.22.0, rotate cloud, npm, and AI tool API keys, and block C2 IPs 37.27.122.124 and 57.128.246.79.",
      "detectedByAnomity": true
    }
  }
}