erroneo.us
Search all guides⌘K

Digest · Saturday

Security digest: July 11, 2026

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: jscrambler npm Compromise: Infostealer in CLI Releases. Teams that use the jscrambler CLI or its webpack, gulp, grunt or Metro plugins and installed or updated them on or after July 11, 2026 without a lockfile pinning an older version.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Supply-chain compromise

jscrambler npm Compromise: Infostealer in CLI Releases

Only builds that installed one of the poisoned versions during a roughly three-hour window on July 11 are at risk, but any machine that did should be treated as compromised.

Must act: Teams that use the jscrambler CLI or its webpack, gulp, grunt or Metro plugins and installed or updated them on or after July 11, 2026 without a lockfile pinning an older version.

Can relax: Users of Jscrambler's hosted products only (Webpage Integrity, Iframe Integrity), and projects whose lockfiles pinned jscrambler 8.13.0 or earlier throughout July 11-13.

  1. Search lockfiles and node_modules for the five bad jscrambler versions and the four plugin versions.
  2. Upgrade to jscrambler 8.22.0 or later and reinstall from a clean state, with caches purged.
  3. On any machine or CI runner that installed a bad version, rotate every credential it could reach: cloud keys, npm and GitHub tokens, AI-tool API keys, wallet secrets.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.