A Trusted Security Tool Was Poisoned to Steal the Keys Inside Your AI Assistant

The theft began the moment you typed install

On July 11, 2026, installing one version of a widely used developer tool was enough to hand over your secrets. The tool was jscrambler, a package published by a security company that sells code protection. Version 8.14.0 carried a hidden program that woke up during installation, swept the machine for credentials, and shipped them to a server over an encrypted connection. Socket, a supply-chain security firm, caught it six minutes after it went live.

What the stealer reached for is the part worth your attention. Alongside the usual cloud keys and crypto wallets, it went hunting for something newer: the configuration files of AI coding assistants like Claude Desktop, Cursor, and Windsurf, where API keys and the credentials for connected tools now sit. The keys that let an AI write and ship your code have quietly become loot.

What happened

jscrambler is a build-time tool, installed as a dependency or run inside a build pipeline, made by the security vendor of the same name. On July 11 an attacker used a stolen npm publishing credential, a cause Jscrambler later confirmed, to push five poisoned versions (8.14.0, 8.16.0, 8.17.0, 8.18.0 and 8.20.0) to npm, the registry that hosts JavaScript packages, over roughly three hours. A version in between, 8.15.0, appears clean. The company deprecated the bad releases and told users to move to 8.22.0. Socket flagged the first version within six minutes, and StepSecurity and SafeDep pulled the code apart and found no matching commit in the project's public source on GitHub, which confirmed the published package was not what the maintainers had written.

The early releases hid the attack in a preinstall hook, a script that npm runs automatically before a package finishes installing. That script picked a native program matched to the operating system out of a 7.8 megabyte bundle, wrote it under a random name in a temporary folder, and launched it silently. The program was an infostealer written in Rust and built for Windows, macOS and Linux. It read cloud credentials for AWS, Azure and Google Cloud, including the internal metadata endpoints that continuous-integration (CI) build servers rely on, cryptocurrency wallets and their recovery phrases, a Bitwarden password vault, browser passwords and cookies, and login sessions for Slack, Discord and Telegram, then sent them out over TLS, the same encryption that protects ordinary web traffic and helps the theft blend in. Its newer target was the config files for AI coding tools, where developers keep API keys and Model Context Protocol (MCP) credentials, the connectors that let an assistant reach a database, a repository or a cloud account. Partway through the campaign the attacker moved the payload out of the install hook and into the package's main code, so it fired when the package was simply imported or run. That change defeats a common defense, installing with scripts turned off.

• Jscrambler sells code protection, so a company whose product is trust became the delivery vehicle, undone by a single stolen publishing account.
• The package sees about 15,800 downloads a week, small next to the giant npm compromises of the past year, but it lives on build machines and in CI, where the credentials are richest.
• Deprecating a version does not remove it. Any project still pinned to 8.14.0 keeps installing the stealer, and on older npm clients the install script still runs without asking.

Why it matters

The measured damage is unconfirmed. npm currently reports zero downloads of the poisoned versions, but that count lags by hours, so silence is not yet proof that no machine ran the code. The exposure is sharper than the download number suggests, because one infected CI server can hold the keys to an entire cloud estate, not just a single laptop. If your engineers use AI coding assistants, this campaign is the moment those tools stop being a productivity footnote and become an asset to inventory. The API keys and MCP connectors inside Cursor or Claude Desktop can reach the same systems your cloud credentials do, and they now sit on the standard theft list. The broader shift is where the trust broke. This was not an obscure package maintained by a lone hobbyist. It was a security vendor's own release, poisoned through a stolen npm credential, landing three days after npm shipped a version that turns install scripts off by default. The attacker answered by moving the payload to where that new protection could not see it. Supply-chain trust, it turns out, is only ever as strong as the individual account allowed to publish.

What to do about it

1. Move off the poisoned versions and treat any machine that ran one as breached, not merely exposed. Upgrade to jscrambler 8.22.0, clear 8.14.0 and its siblings from lockfiles and caches, and if a bad version ran, rotate every secret it could reach, because a stealer finishes its work in the seconds after install and later cleanup does not un-steal a key.
2. Rotate and narrow the credentials your AI tools hold, not just your cloud keys. The config files for Claude Desktop, Cursor and Windsurf were named targets, so revoke and reissue their API and MCP credentials and give each one the least access it needs, because a stolen key that can read a single storage bucket is worth far less than one that can reach everything.
3. Keep publishing credentials and cloud secrets out of build environments and behind hardware-backed MFA (multi-factor authentication, the second login step beyond a password). The whole compromise began with one publishing account an attacker could use, so a phishing-resistant second factor on every account that can push a package or read a secret raises the cost of the next stolen credential.

Bottom line

Jscrambler moved quickly, and there may turn out to be no victims at all. What makes this one worth keeping is not the size of the loss but the shape of the target list. A commodity infostealer, hidden inside a trusted security tool, now reaches past your cloud keys to the credentials your AI assistants carry, because those assistants can touch everything your developers can. Bring one question to your next security review: if a stealer ran on the laptop of an engineer who uses an AI coding assistant, do you know what that assistant's keys can reach, and could you revoke them before an attacker did? Jscrambler's security advisory lists the affected versions and the indicators to hunt for.