The GitHub Advanced Security team says the Jscrambler npm package compromise was detected and disclosed. The artifact is a client-side web security vendor whose own supply-chain distribution channel served an infostealer to roughly 1,500 downloads before anyone caught it. Jscrambler sells code obfuscation to stop reverse engineering. The payload rode in on the one channel obfuscation was never built to guard.

The mechanism matters more than the download count. A compromised npm publish credential, not a vulnerability in the obfuscation logic itself, is what let the attacker replace a trusted package version with one carrying an infostealer, meaning every downstream build pipeline that ran `npm install` without pinning a hash pulled the malicious version automatically. The same week, Google and Microsoft pulled ModHeader, a Chrome and Edge extension with 1.6 million installs, after researchers found an undisclosed browsing-history collector inside it. Two unrelated vendors, two trusted-distribution channels, one control that would have stopped both: dependency pinning by hash rather than by version tag, checked in CI before any package reaches a build. Neither incident required a new technique. Both required someone to trust a channel that had stopped verifying what it shipped.