jscrambler npm Package Supply Chain Compromise (v8.14.0 Malicious Release)

jscrambler npm Package Supply Chain Compromise (v8.14.0 (TL-2026-1233), also tracked as jscrambler 8.14.0 malicious release, is a high-severity supply-chain compromise, first published 2026-07-11. It has no confirmed attribution, affects Jscrambler jscrambler (npm package), maps to 22 MITRE ATT&CK techniques (T1005, T1027, T1027.002), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-1233

Threat ID
TL-2026-1233
Also known as
jscrambler 8.14.0 malicious release, jscrambler preinstall hook compromise
Severity
HIGH
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-07-11
Last reviewed
2026-07-11
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, software-development, web-development, mobile-development
Target regions
Global
Detection rules
9
Indicators of compromise
15

Malware and tooling in jscrambler npm Package Supply Chain Compromise (v8.14.0

Malware and tooling: Socket

On 2026-07-11, version 8.14.0 of the jscrambler npm package (~15,800 weekly downloads) was published with a malicious, undocumented preinstall hook that automatically executed obfuscated, platform-specific native binaries (Windows, macOS, Linux) during npm install, before any application code ran. Socket detected the compromise 6 minutes after publication and notified the maintainers; the full capability of the embedded binaries and the number of affected downstream users remain undetermined.

How jscrambler npm Package Supply Chain Compromise (v8.14.0 works

Jscrambler is a JavaScript code-protection tool integrated into many organizations' build pipelines via the `jscrambler` npm package. On 2026-07-11 an attacker published a malicious release, version 8.14.0, that diverged sharply from the prior clean release, 8.13.0. The malicious package added two new install-time components — `dist/setup.js` and `dist/intro.js` — and wired an undocumented `preinstall` lifecycle hook so that `dist/setup.js` executed automatically the moment `npm install jscrambler` (or any dependency resolution that pulled in the version) ran, with no user interaction, no import statement, and no application code execution required.

At runtime, the preinstall script selected and executed one of three bundled native binaries based on the detected host platform (Windows, macOS, or Linux). The binaries were shipped obfuscated inside CSI (packed/obfuscated executable) containers, consistent with an attempt to defeat static analysis and antivirus signature matching. Socket's automated supply-chain monitoring flagged the release roughly six minutes after it hit the npm registry — fast enough that exposure was likely limited, though the precise number of installs that pulled the malicious version before removal/pinning is unknown, since `jscrambler` is consumed both by individual developer workstations and by CI/CD build systems that run `npm install` unattended and often hold elevated build/deploy credentials.

As of the source reporting, analysts had not observed the embedded binaries performing overt command-and-control callbacks, credential exfiltration, or cryptomining — but because the code runs with the full privileges of the invoking `npm install` process (developer laptop or CI runner), it had latent access to source code, environment variables, SSH/npm/CI tokens, cloud credentials, and any other secrets exposed to the build environment. This is a textbook install-script supply-chain compromise: attacker compromises a maintainer's publish credentials or the publish pipeline, ships a single poisoned release, and relies on npm's default execution of lifecycle scripts to gain code execution across every downstream consumer that upgrades before the compromise is caught. Socket reported the incident to the Jscrambler maintainers and it is being tracked publicly via a GitHub issue on the jscrambler repository.

No CVE has been assigned, no threat actor has been attributed, and no malware family name has been disclosed as of publication. The precise compromise vector used to publish the malicious release (e.g. stolen npm publish token, phished maintainer 2FA, compromised CI publish pipeline) was not disclosed in public reporting. Organizations that resolved dependencies during the exposure window should treat any environment that ran `npm install`/`npm ci` against jscrambler@8.14.0 as potentially compromised, rotate any credentials available to that environment, and pin back to jscrambler@8.13.0 or a later verified-clean release once one is published.

MITRE ATT&CK techniques used in TL-2026-1233

Collection

T1005 Data from Local System; T1119 Automated Collection

Defense Evasion

T1027 Obfuscated Files or Information; T1027.002 Software Packing; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location

Execution

T1059.007 JavaScript; T1072 Software Deployment Tools; T1106 Native API; T1204.003 Malicious Image

Discovery

T1082 System Information Discovery; T1614.001 System Language Discovery

Initial Access

T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain

Credential Access

T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1552.002 Credentials in Registry

Persistence

T1546.016 Installer Packages

Resource Development

T1586 Compromise Accounts; T1587.001 Malware; T1608.001 Upload Malware

Affected products and versions in jscrambler npm Package Supply Chain Compromise (v8.14.0

  • Jscrambler — jscrambler (npm package)
    Vulnerable versions: 8.14.0
    Fixed in: 8.13.0 (last known-clean; roll back pending official remediation)

Remediation for jscrambler npm Package Supply Chain Compromise (v8.14.0

Patches

  • No patched release of 8.14.0 has been published as of this writing; consumers must roll back to jscrambler@8.13.0 pending an official clean re-release

Immediate actions

  • Remove/uninstall jscrambler@8.14.0 from all package.json, lockfiles, and node_modules trees immediately
  • Pin jscrambler to the last known-clean version, 8.13.0, or a later verified-clean release until the maintainers confirm the registry is clean
  • Audit npm install/CI build logs for execution of dist/setup.js or dist/intro.js during the exposure window (published 2026-07-11 through detection +6 minutes and any subsequent mirror/cache propagation)
  • Treat any developer workstation or CI/CD runner that resolved jscrambler@8.14.0 as potentially compromised
  • Rotate all credentials, tokens, and secrets exposed to environments that ran npm install against the malicious version (npm publish tokens, CI/CD deploy keys, cloud credentials, SSH keys, environment variable secrets)
  • Quarantine and forensically capture the platform-specific native binaries dropped during install for malware analysis before deleting node_modules

Workarounds

  • Set ignore-scripts=true in .npmrc to prevent preinstall/postinstall hooks from executing automatically during install
  • Use a private registry proxy/allowlist that blocks unvetted package versions from reaching build agents

Longer-term hardening

  • Disable npm lifecycle script execution by default (npm config set ignore-scripts true) except where explicitly vetted
  • Adopt lockfile integrity verification and dependency pinning (exact versions, not ranges) for security-sensitive build-tooling packages
  • Deploy a software composition analysis / supply-chain monitoring tool (e.g. Socket, npm audit signatures) in CI to catch malicious releases before they reach build agents
  • Isolate CI/CD build agents from long-lived credentials; use short-lived, scoped tokens injected only at deploy time
  • Require maintainer 2FA and publish-time provenance attestation (npm provenance / Sigstore) for all packages integrated into build pipelines

Weaknesses (CWE) in jscrambler npm Package Supply Chain Compromise (v8.14.0

CWE-506, CWE-829, CWE-494, CWE-1104

Timeline of jscrambler npm Package Supply Chain Compromise (v8.14.0

  • Total number of affected downstream installs and the full capability of the embedded binaries remain undetermined at time of reporting.
  • Socket publishes a public blog post disclosing the jscrambler npm supply chain attack, noting no confirmed C2, credential-theft, or cryptomining functionality observed at time of analysis.
  • Incident tracking opened via a public GitHub issue on the jscrambler repository.
  • Socket reports the compromise to the Jscrambler maintainers.
  • Socket's automated supply-chain monitoring detects the malicious release approximately 6 minutes after publication.
  • Any consumer running npm install against jscrambler@8.14.0 during the exposure window triggers execution of dist/setup.js and dist/intro.js, which select and launch a platform-specific obfuscated binary.
  • jscrambler@8.14.0 published to the npm registry containing an undocumented preinstall hook and platform-specific obfuscated binaries for Windows, macOS, and Linux.
  • jscrambler@8.13.0, the last known-clean release, is the version immediately preceding the compromise.

Sources cited for jscrambler npm Package Supply Chain Compromise (v8.14.0

Threats related to jscrambler npm Package Supply Chain Compromise (v8.14.0

Detection coverage for TL-2026-1233

As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1233 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats