Compromised npm package jscrambler (official CLI for the Jscrambler Code Integrity API). Multiple malicious versions were published to npm on 2026-07-11 carrying a malicious preinstall hook that drops a binary performing credential and cryptocurrency theft: it reads Chrome/Firefox credential stores and Chromium Local Storage/IndexedDB, targets crypto wallet extensions (e.g. MetaMask) and BIP39 seed phrases, and uses Tor-based command-and-control plus Linux eBPF instrumentation. Affected versions: 8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0.