signal insight

npm supply-chain attack on the Jscrambler package harvests MCP server credentials…

On July 11, 2026, a compromised jscrambler npm package (version 8.14.0) used a preinstall hook to drop native binaries that specifically harvested Model Context Protocol server configurations and API keys from AI coding tools, including Claude Desktop, Cursor, Windsurf, and VS Code, according to Socket's analysis.

Published Jul 11, 2026 Updated Jul 19, 2026 1 sources

npm (Jscrambler package)jscrambler npm packagesecuritysecurityhigh impact

securityai-coding-toolsagents

Impact: high
Confidence: 80%
Change type: security
First seen: Jul 11, 2026
Last updated: Jul 19, 2026
Audience: developerssecurityplatform-engineers
Status: Ready

Summary

What changed

A malicious jscrambler npm release (8.14.0) shipped a preinstall hook deploying Linux, macOS, and Windows binaries that stole MCP server configs and API keys from Claude Desktop (.claude.json), Cursor (.cursor/mcp.json), Windsurf (.codeium/windsurf/mcp_config.json), and VS Code (.mcp.json).

Why it matters

MCP config files have quietly become a high-value credential store; a supply-chain attack that names AI coding tools as targets raises the security bar for how agent tools store secrets and for scanning dependencies that can read those configs, making developer workstations a front line for AI credential theft.

Evidence excerpt

The malware targeted Claude Desktop (.claude.json), Cursor (.cursor/mcp.json), Windsurf (.codeium/windsurf/mcp_config.json), and VS Code (.mcp.json) containing MCP server credentials, designed to extract Model Context Protocol (MCP) server configurations, which frequently contain API keys.

Sources

socket.dev