How a preinstall hook silently ran malware on npm install

Short summary

Malicious versions of the jscrambler npm package used a preinstall hook to silently deploy a Rust-based infostealer targeting browser credentials, crypto wallets, and Bitwarden vaults across Linux, Windows, and macOS. The attack exploited npm's automatic script execution model, where arbitrary third-party code runs with user permissions before the package is even on disk. AI coding agents that run npm install without human oversight amplify this risk since no one monitors install output for credential-stealing payloads.

• •Five malicious jscrambler npm versions deployed a cross-platform Rust infostealer via preinstall hooks over ~3 hours
• •Payload targeted browser credential stores, crypto wallets, and Bitwarden vaults with Tor-based exfiltration and persistence
• •AI coding agents running unsupervised npm installs create a blind spot where supply-chain attacks execute without human review

Generated with AI, which can make mistakes.