jscrambler npm Supply Chain Attack — IronWorm Rust Infostealer

Timeline: July 11, 2026 (all times UTC): 14:51-14:53 UTC: two failed GitHub Release automation runs on employee account — first visible signs. 15:12:40 UTC: malicious 8.14.0 published to npm using stolen token. Socket.dev flags the release 6 minutes after publication with maximum suspicion score. 15:50 UTC: SSH key removed from GitHub, 8.14.0 deprecated. 17:10 UTC: clean 8.15.0 published. 17:37 UTC: attacker publishes 8.16.0 and 8.17.0 (using the stolen npm token, still active because Jscrambler had only rotated the developer's credentials). 17:45 UTC: 8.18.0 collision — Jscrambler and attacker publish simultaneously, attacker's version lands first. 17:50 UTC: 8.20.0 published by attacker. 17:55 UTC: 2FA enforced on npm publishing. 18:12 UTC: stolen npm token identified and revoked, clean 8.22.0 published. Attack ends. Active window: ~3 hours. July 13, 2026: 08:37 UTC npm removes the malicious package versions. 11:56 UTC public reports confirm 8.18.0 is also infected. 12:23 UTC the 4 downstream packages pinned to 8.18.0 identified. Jscrambler publishes official advisory + post-mortem with 4 updates through July 15. JFrog identifies payload as IronWorm (Rust infostealer, Shai-Hulud lineage) with self-propagation routine. StepSecurity, Socket.dev, Reflectiz, The Hacker News, BleepingComputer, SecurityWeek publish forensic analyses. Recommended action for affected users: treat host as compromised, move crypto assets from any wallet whose extension storage may have been accessible to a new wallet with a freshly generated seed phrase on a clean device.