jscrambler npm Package Supply Chain Compromise (v8.14.0 Malicious Release)

Key facts for jscrambler 8.14.0 preinstall hook

Detection coverage for jscrambler 8.14.0 preinstall hook

As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1233 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: npm Install Spawns Child Process via Undocumented Lifecycle Hook — Exploitation

Detects node.exe/node spawning cmd.exe, powershell.exe, or an unlabeled binary as a child process during npm install/npm ci, consistent with a malicious preinstall/postinstall lifecycle hook (as in jscrambler@8.14.0) executing dist/setup.js before any application code runs.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.001, T1546.016, T1059.007
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(ParentImage, "(?i)\\node\.exe$")
| where match(Image, "(?i)\\(cmd|powershell|pwsh)\.exe$") OR match(CommandLine, "(?i)dist[\\/](setup|intro)")
| eval parent_cmdline_lower=lower(ParentCommandLine)
| where match(parent_cmdline_lower, "npm (install|ci)") OR match(parent_cmdline_lower, "node-gyp") = 0
| table _time, ComputerName, User, ParentImage, ParentCommandLine, Image, CommandLine, ProcessId
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "node.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe") or ProcessCommandLine has_any ("dist/setup", "dist\\setup", "dist/intro", "dist\\intro")
| where InitiatingProcessCommandLine has_any ("npm install", "npm ci")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessId
| order by Timestamp desc

Sigma

title: npm Lifecycle Script Spawning Suspicious Child Process
id: 8b3e2a10-4c1a-4a5e-9c3e-jscrambler001
status: experimental
description: Detects node.exe spawning a command shell or unexpected binary via an npm install/ci preinstall or postinstall lifecycle hook, consistent with a supply-chain compromised package (e.g. jscrambler 8.14.0) executing install-time payloads.
references:
    - https://socket.dev/blog/jscrambler-supply-chain-attack
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-11
tags:
    - attack.initial-access
    - attack.t1195.001
    - attack.execution
    - attack.t1059.007
    - attack.persistence
    - attack.t1546.016
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\node.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_lifecycle:
        ParentCommandLine|contains:
            - 'npm install'
            - 'npm ci'
    filter_common:
        CommandLine|contains:
            - 'node-gyp'
            - 'electron-rebuild'
    condition: selection_parent and selection_child and selection_lifecycle and not filter_common
falsepositives:
    - Legitimate npm postinstall/build scripts compiling native addons (node-gyp, electron-rebuild)
level: high

Known false positives:

• Legitimate npm postinstall/build scripts that compile native addons (node-gyp, electron-rebuild, sharp)

Tuning notes: Baseline known-good packages that legitimately spawn native-build children during install (node-gyp, sharp, electron-rebuild) and exclude their package names from CommandLine matching; tighten to specific dist/setup.js or dist/intro.js filenames once the compromised package is identified in your environment.

• 🔒 npm Registry Package Install Triggers Preinstall Hook Executing Unexpected Binary — Exploitation · unlock with TL Creds
• 🔒 Newly-Installed Package Drops Packed/Obfuscated Native Binary with No Prior Signature — Post-Exploitation · unlock with TL Creds
• 🔒 Post-Install Outbound Connection from node.exe/node Child-Process Tree to Unfamiliar Destination — C2/Exfil · unlock with TL Creds
• 🔒 Sigma — npm preinstall Hook Spawns Command Shell from node.exe · unlock with TL Creds
• 🔒 Sigma — Installer Package Lifecycle Hook Persistence via package.json preinstall/postinstall · unlock with TL Creds
• 🔒 Sigma — Package Version Bump with Anomalous New Native Binary Payloads (SCA Signal) · unlock with TL Creds
• 🔒 Platform-Detection Followed by Obfuscated/Packed Binary Execution Post-Install · unlock with TL Creds
• 🔒 CI/Build Process Reads Credential-Shaped Environment Variables Immediately After npm Install · unlock with TL Creds

Indicators of compromise for jscrambler 8.14.0 preinstall hook

As of 2026-07-11, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-1233.

How jscrambler 8.14.0 preinstall hook works

Jscrambler is a JavaScript code-protection tool integrated into many organizations' build pipelines via the `jscrambler` npm package. On 2026-07-11 an attacker published a malicious release, version 8.14.0, that diverged sharply from the prior clean release, 8.13.0. The malicious package added two new install-time components — `dist/setup.js` and `dist/intro.js` — and wired an undocumented `preinstall` lifecycle hook so that `dist/setup.js` executed automatically the moment `npm install jscrambler` (or any dependency resolution that pulled in the version) ran, with no user interaction, no import statement, and no application code execution required.

At runtime, the preinstall script selected and executed one of three bundled native binaries based on the detected host platform (Windows, macOS, or Linux). The binaries were shipped obfuscated inside CSI (packed/obfuscated executable) containers, consistent with an attempt to defeat static analysis and antivirus signature matching. Socket's automated supply-chain monitoring flagged the release roughly six minutes after it hit the npm registry — fast enough that exposure was likely limited, though the precise number of installs that pulled the malicious version before removal/pinning is unknown, since `jscrambler` is consumed both by individual developer workstations and by CI/CD build systems that run `npm install` unattended and often hold elevated build/deploy credentials.

As of the source reporting, analysts had not observed the embedded binaries performing overt command-and-control callbacks, credential exfiltration, or cryptomining — but because the code runs with the full privileges of the invoking `npm install` process (developer laptop or CI runner), it had latent access to source code, environment variables, SSH/npm/CI tokens, cloud credentials, and any other secrets exposed to the build environment. This is a textbook install-script supply-chain compromise: attacker compromises a maintainer's publish credentials or the publish pipeline, ships a single poisoned release, and relies on npm's default execution of lifecycle scripts to gain code execution across every downstream consumer that upgrades before the compromise is caught. Socket reported the incident to the Jscrambler maintainers and it is being tracked publicly via a GitHub issue on the jscrambler repository.

No CVE has been assigned, no threat actor has been attributed, and no malware family name has been disclosed as of publication. The precise compromise vector used to publish the malicious release (e.g. stolen npm publish token, phished maintainer 2FA, compromised CI publish pipeline) was not disclosed in public reporting. Organizations that resolved dependencies during the exposure window should treat any environment that ran `npm install`/`npm ci` against jscrambler@8.14.0 as potentially compromised, rotate any credentials available to that environment, and pin back to jscrambler@8.13.0 or a later verified-clean release once one is published.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1119 Automated Collection

Defense Evasion

T1027 Obfuscated Files or Information; T1027.002 Software Packing; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location

Execution

T1059.007 JavaScript; T1072 Software Deployment Tools; T1106 Native API; T1204.003 Malicious Image

Discovery

T1082 System Information Discovery; T1614.001 System Language Discovery

Initial Access

T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain

Credential Access

T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1552.002 Credentials in Registry

Persistence

T1546.016 Installer Packages

Resource Development

T1586 Compromise Accounts; T1587.001 Malware; T1608.001 Upload Malware

Remediation for jscrambler 8.14.0 preinstall hook

Patches

• No patched release of 8.14.0 has been published as of this writing; consumers must roll back to jscrambler@8.13.0 pending an official clean re-release

Immediate actions

• Remove/uninstall jscrambler@8.14.0 from all package.json, lockfiles, and node_modules trees immediately
• Pin jscrambler to the last known-clean version, 8.13.0, or a later verified-clean release until the maintainers confirm the registry is clean
• Audit npm install/CI build logs for execution of dist/setup.js or dist/intro.js during the exposure window (published 2026-07-11 through detection +6 minutes and any subsequent mirror/cache propagation)
• Treat any developer workstation or CI/CD runner that resolved jscrambler@8.14.0 as potentially compromised
• Rotate all credentials, tokens, and secrets exposed to environments that ran npm install against the malicious version (npm publish tokens, CI/CD deploy keys, cloud credentials, SSH keys, environment variable secrets)
• Quarantine and forensically capture the platform-specific native binaries dropped during install for malware analysis before deleting node_modules

Workarounds

• Set ignore-scripts=true in .npmrc to prevent preinstall/postinstall hooks from executing automatically during install
• Use a private registry proxy/allowlist that blocks unvetted package versions from reaching build agents

Longer-term hardening

• Disable npm lifecycle script execution by default (npm config set ignore-scripts true) except where explicitly vetted
• Adopt lockfile integrity verification and dependency pinning (exact versions, not ranges) for security-sensitive build-tooling packages
• Deploy a software composition analysis / supply-chain monitoring tool (e.g. Socket, npm audit signatures) in CI to catch malicious releases before they reach build agents
• Isolate CI/CD build agents from long-lived credentials; use short-lived, scoped tokens injected only at deploy time
• Require maintainer 2FA and publish-time provenance attestation (npm provenance / Sigstore) for all packages integrated into build pipelines

Affected and fixed versions

• Jscrambler — jscrambler (npm package)
  Vulnerable versions: 8.14.0
  Fixed in: 8.13.0 (last known-clean; roll back pending official remediation)

Timeline of jscrambler 8.14.0 preinstall hook

• 2026-07-11 Total number of affected downstream installs and the full capability of the embedded binaries remain undetermined at time of reporting.
• 2026-07-11 locked-ioc-14 publishes a public blog post disclosing the locked-ioc-13 npm supply chain attack, noting no confirmed C2, credential-theft, or cryptomining functionality observed at time of analysis.
• 2026-07-11 Incident tracking opened via a public GitHub issue on the locked-ioc-13 repository.
• 2026-07-11 locked-ioc-14 reports the compromise to the locked-ioc-13 maintainers.
• 2026-07-11 locked-ioc-14's automated supply-chain monitoring detects the malicious release approximately 6 minutes after publication.
• 2026-07-11 Any consumer running npm install against locked-ioc-9 during the exposure window triggers execution of locked-ioc-11 and locked-ioc-12, which select and launch a platform-specific obfuscated binary.
• 2026-07-11 locked-ioc-9 published to the npm registry containing an undocumented preinstall hook and platform-specific obfuscated binaries for Windows, macOS, and Linux.
• 2026-07-11 locked-ioc-10, the last known-clean release, is the version immediately preceding the compromise.

Sources cited for jscrambler 8.14.0 preinstall hook

• Reporting malware in an npm package docs.npmjs.com · Advisory · 2026-01-01
• Software supply chain attacks: check your dependencies NCSC (UK) · Advisory · 2026-01-01
• The npm Threat Landscape: Attack Surface and Mitigations Unit 42 · Research · 2026-06-02
• jscrambler npm Supply Chain Attack socket.dev · Blog · 2026-07-11
• Defending Against npm Supply Chain Attacks: A Practical Guide to Detection, Emulation, and Analysis splunk.com · Blog · 2026-01-01
• npm v12 Ships This Month, Blocking Install Scripts That Enabled Year of Supply Chain Attacks techtimes.com · News · 2026-07-08

Threats related to jscrambler 8.14.0 preinstall hook

• Jscrambler npm Package Compromised: IronWorm Cross-Platform Infostealer (Shai-Hulud Lineage) via Rust Native Binaries
• Compromised jscrambler npm Package v8.14.0 Drops Rust Infostealer via Preinstall Hook
• Binding.gyp "Phantom Gyp" Supply Chain Attack (Miasma Worm) Enables CI/CD Worm Propagation Across 57 npm Packages
• Claude Code MCP Traffic Hijack via Malicious npm postinstall — ~/.claude.json Tampering Proxies MCP Endpoints to Steal Persistent OAuth Bearer Tokens (Mitiga Labs PoC)
• Braintree.Net NuGet Typosquat Uses XOR-Obfuscated WebSocket/HTTPS C2 to Exfiltrate Live Payment Card Data and Merchant Credentials

Related coverage of this activity

• Miasma LeoPlatform Bun payload
• SleeperGem RubyGems dormant accounts
• PyTorch Lightning PyPI compromise
• Injective npm wallet key stealer

Previous and next in supply chain

• GhostCommit: PNG-Steganography Prompt Injection Bypasses AI Code Reviewers and Coding Agents to Exfiltrate Secrets Previous report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages