Malicious jscrambler npm version 8.14.0 dropped a Rust infostealer that stole credentials and crypto wallet data during installation.