Initially the attackers launched new bundle variations with two malicious scripts that get executed at set up time utilizing a preinstall hook within the configuration script. The scripts additionally execute platform-specific binaries for Linux, macOS, and Home windows embedded in an obfuscated container.
As a result of preinstall or postinstall hooks are frequent methods to ship malware in npm packages, they’re robotically checked by safety instruments. To keep away from detection, the attackers pivoted to a technique that concerned injecting the malicious code immediately within the dist/index.js and dist/bin/jscrambler.js information. This modified the malware execution from bundle set up time to when the bundle will get imported into different tasks or the Jscrambler CLI is invoked.
The embedded malware executables for various platforms are written in Rust and, in line with Socket.dev’s evaluation, have been “a broad, developer-focused credential and secret harvester” that focused browser-extension crypto wallets, API keys from AI coding assistants and MCP servers, cloud credentials for AWS, Azure and GCP, authentication tokens for messaging functions (akin to Discord, Slack, and Telegram), password shops from browsers, Steam, and KDE.
