jscrambler npm compromise: your AI assistant keys are the target

Supply-chain malware used to want your AWS keys. This one wants those too — and then it goes looking for your MCP server configs. The jscrambler npm compromise is the clearest signal yet that the credential store sitting inside your AI coding assistant is now a first-class target, and most teams have never once thought about what's in it.

What actually happened

On July 11, 2026, an attacker used stolen publishing credentials to push malicious releases of jscrambler, a package pulling roughly 15,800 weekly downloads. Socket's research team flagged the first bad release, 8.14.0, six minutes after it went live. Five versions were affected in total — 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0 — along with the companion webpack, gulp, grunt, and metro plugins, per GitGuardian.

Two details matter more than the rest.

First, the delivery changed mid-campaign. Versions 8.14.0 through 8.17.0 used an undocumented preinstall hook that ran dist/setup.js, which unpacked a 7.8 MB binary container and spawned a platform-specific payload — Linux ELF, Windows PE32+, or macOS Mach-O arm64 — detached, with stdio discarded. Then 8.18.0 dropped the install hook entirely and injected a self-executing function straight into dist/index.js and dist/bin/jscrambler.js. That version runs on import or CLI invocation, which means npm install --ignore-scripts does not save you. The attacker adapted to the exact defense the ecosystem just standardized on.

Second, the target list. Beyond the expected cloud paths — GCP metadata and Secret Manager, AWS ECS metadata, Secrets Manager and SSM Parameter Store, Azure IMDS — the stealer specifically enumerates credentials from Claude Desktop, Cursor, Windsurf, Factory, Zed, and VS Code, going after MCP server configurations and API keys. Roughly 2,400 sensitive strings in the binary were individually encrypted with ChaCha20-Poly1305 to slow down exactly this kind of analysis.

Why AI assistant credentials matter for your business

Think about what an MCP config actually holds. Not just a model API key — connection strings, repo tokens, Slack and database credentials, whatever you wired up so your assistant could be useful. Teams treat that file as local convenience tooling. An attacker treats it as a pre-assembled map of everything you have access to, already scoped and labeled.

We build agent integrations for clients, and this is the part we're most opinionated about: an MCP server should hold a narrow, revocable token, not the same credential your CI uses. If you can't answer "what would an attacker get from my assistant's config" in under a minute, that's the work item.

Sources: Socket, GitGuardian, SecurityWeek.