Portugal
PRT
Jscrambler npm publishing compromise distributes malicious software releases
An attacker compromised a Jscrambler developer machine, obtained GitHub access and exfiltrated an npm publishing token through the company's workflow. On 11 July 2026 the attacker used Jscrambler's legitimate publishing path to release multiple malicious jscrambler versions and dependent plugins; Jscrambler reported 1,479 downloads of affected packages and no confirmed customer impact.
66
Estimated severity
66 / 100
93
Source reliability
93 / 100
Approximate Date
2026-07-11
Targeted Company
JSCRAMBLER
Targeted Company Supply Chain Impact
Distribution & Fulfillment
Procurement & Sourcing
Production & Manufacturing
Sales (Retail & Ecommerce)
Warehousing
Service Delivery
Unrecognized Impact
Supply Chain Relations
No information
Geographic Impact
Country Targeted Company
Other Affected Countries
No other affected countries reported
Target country
Portugal
Affected countries
Portugal
Impacted regions
No information
Operational Impact
Duration
No information
Financial impact (USD M)
No information
Impact types
Supply chain data integrity impact
Affected sectors
Technology & IT Services
Affected departments
Engineering & MaintenanceInformation Technology
Attack Profile
Attack types
Data exfiltrationMalwareSoftware supply chain compromiseUnauthorized accessUse of stolen credentials
Attributed threat actors
No information
Sources
Incident Sources