Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install
2026-07-12T13:24:12Z•0815e7b11d668930be6c3b563942b217ad294234bd7f3493b62f438f0040e8f0
bootloadercryptocurrencygigawipergithub-compromisehardware-attackincident-responseinfostealerinjective-labsjscramblermodbeaconnpmpatchingransomwarerogueplanetrust-malwaresharefilestorage-zone-controllerstored-xsssupply-chaintangemu-bootwallet-theftxquicxrINGzimbra
What happened
This feed aggregates multiple high-impact security incidents and advisories: a compromised jscrambler npm release (8.14.0) containing a preinstall hook that drops a Rust infostealer; a GitHub compromise of Injective Labs that published a wallet-key-stealing npm package (@injectivelabs/sdk-ts@1.20.21); a critical stored XSS in Zimbra Classic Web Client enabling arbitrary script execution in user sessions (no CVE yet); Progress advising ShareFile customers to shut down Storage Zone Controllers due to a credible external threat; six new U-Boot vulnerabilities (four crash, two allow code execution
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 0815e7b11d668930be6c3b563942b217ad294234bd7f3493b62f438f0040e8f0
- Enrichment time
- 2026-07-12T13:24:12Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.