RE: https://fosstodon.org/@SocketSecurity/116902188963272487 🚨 Update: The jscrambler attacker published four more malicious releases: 8.16.0, 8.17.0, 8.18.0, and 8.20.0 with the same infostealer payload. In 8.18.0 and 8.20.0, the dropper moved out of preinstall and into package code, bypassing npm install --ignore-scripts. Jscrambler says an npm publishing credential was compromised. Upgrade to 8.22.0. We've updated our technical analysis.