Official jscrambler npm Package Compromised at 8.14.0
The official jscrambler npm package was compromised at version 8.14.0, introducing malicious code into the dependency chain.
R/PROGRAMMING (TOP) — Developers using this version should update immediately and audit their projects for potential exposure to the compromised artifact.
The official jscrambler npm package was compromised at version 8.14.0, with malicious code injected into the dependency chain. jscrambler is a widely used code obfuscation and protection tool distributed through npm, making this a significant supply chain security incident affecting potentially thousands of projects that depend on the package.
Developers who installed or updated to version 8.14.0 are at risk and should immediately upgrade to a patched version. A thorough audit of affected projects is recommended to identify any systems that may have been exposed to the compromised artifact and to assess whether the malicious code was executed during installation or build processes.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Waiting for your click …
·