# jscrambler npm Package Supply Chain Compromise (v8.14.0 Malicious Release)

> On 2026-07-11, version 8.14.0 of the jscrambler npm package (~15,800 weekly downloads) was published with a malicious, undocumented preinstall hook that automatically executed obfuscated, platform-specific native binaries (Windows, macOS, Linux) during npm install, before any application code ran. Socket detected the compromise 6 minutes after publication and notified the maintainers; the full capability of the embedded binaries and the number of affected downstream users remain undetermined.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1233
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-jscrambler-8-14-0-preinstall-hook-tl-2026-1233.webp?v=e26229cf (Threadlinqs threat intel: jscrambler 8.14.0 Malicious Preinstall: Detection & IOCs (TL-2026-1233) — High severity, 15 IOCs, 9 detection rules.)
- **ID:** TL-2026-1233
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 15

## Description

Jscrambler is a JavaScript code-protection tool integrated into many organizations' build pipelines via the `jscrambler` npm package. On 2026-07-11 an attacker published a malicious release, version 8.14.0, that diverged sharply from the prior clean release, 8.13.0. The malicious package added two new install-time components — `dist/setup.js` and `dist/intro.js` — and wired an undocumented `preinstall` lifecycle hook so that `dist/setup.js` executed automatically the moment `npm install jscrambler` (or any dependency resolution that pulled in the version) ran, with no user interaction, no import statement, and no application code execution required.

At runtime, the preinstall script selected and executed one of three bundled native binaries based on the detected host platform (Windows, macOS, or Linux). The binaries were shipped obfuscated inside CSI (packed/obfuscated executable) containers, consistent with an attempt to defeat static analysis and antivirus signature matching. Socket's automated supply-chain monitoring flagged the release roughly six minutes after it hit the npm registry — fast enough that exposure was likely limited, though the precise number of installs that pulled the malicious version before removal/pinning is unknown, since `jscrambler` is consumed both by individual developer workstations and by CI/CD build systems that run `npm install` unattended and often hold elevated build/deploy credentials.

As of the source reporting, analysts had not observed the embedded binaries performing overt command-and-control callbacks, credential exfiltration, or cryptomining — but because the code runs with the full privileges of the invoking `npm install` process (developer laptop or CI runner), it had latent access to source code, environment variables, SSH/npm/CI tokens, cloud credentials, and any other secrets exposed to the build environment. This is a textbook install-script supply-chain compromise: attacker compromises a maintainer's publish credentials or the publish pipeline, ships a single poisoned release, and relies on npm's default execution of lifecycle scripts to gain code execution across every downstream consumer that upgrades before the compromise is caught. Socket reported the incident to the Jscrambler maintainers and it is being tracked publicly via a GitHub issue on the jscrambler repository.

No CVE has been assigned, no threat actor has been attributed, and no malware family name has been disclosed as of publication. The precise compromise vector used to publish the malicious release (e.g. stolen npm publish token, phished maintainer 2FA, compromised CI publish pipeline) was not disclosed in public reporting. Organizations that resolved dependencies during the exposure window should treat any environment that ran `npm install`/`npm ci` against jscrambler@8.14.0 as potentially compromised, rotate any credentials available to that environment, and pin back to jscrambler@8.13.0 or a later verified-clean release once one is published.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1059.007 JavaScript
- T1072 Software Deployment Tools
- T1106 Native API
- T1204.003 Malicious Image
- T1546.016 Installer Packages
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1082 System Information Discovery
- T1614.001 System Language Discovery
- T1552.001 Credentials In Files
- T1552.002 Credentials in Registry
- T1528 Steal Application Access Token
- T1005 Data from Local System
- T1119 Automated Collection
- T1586 Compromise Accounts
- T1587.001 Malware
- T1608.001 Upload Malware
- T1195.002 Compromise Software Supply Chain

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**npm Install Spawns Child Process via Undocumented Lifecycle Hook — Exploitation** (`TL-2026-1233-SPL-001`)

Detects node.exe/node spawning cmd.exe, powershell.exe, or an unlabeled binary as a child process during npm install/npm ci, consistent with a malicious preinstall/postinstall lifecycle hook (as in jscrambler@8.14.0) executing dist/setup.js before any application code runs.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.001, T1546.016, T1059.007
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(ParentImage, "(?i)\\node\.exe$")
| where match(Image, "(?i)\\(cmd|powershell|pwsh)\.exe$") OR match(CommandLine, "(?i)dist[\\/](setup|intro)")
| eval parent_cmdline_lower=lower(ParentCommandLine)
| where match(parent_cmdline_lower, "npm (install|ci)") OR match(parent_cmdline_lower, "node-gyp") = 0
| table _time, ComputerName, User, ParentImage, ParentCommandLine, Image, CommandLine, ProcessId
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "node.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe") or ProcessCommandLine has_any ("dist/setup", "dist\\setup", "dist/intro", "dist\\intro")
| where InitiatingProcessCommandLine has_any ("npm install", "npm ci")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessId
| order by Timestamp desc
```

### Sigma

```yaml
title: npm Lifecycle Script Spawning Suspicious Child Process
id: 8b3e2a10-4c1a-4a5e-9c3e-jscrambler001
status: experimental
description: Detects node.exe spawning a command shell or unexpected binary via an npm install/ci preinstall or postinstall lifecycle hook, consistent with a supply-chain compromised package (e.g. jscrambler 8.14.0) executing install-time payloads.
references:
    - https://socket.dev/blog/jscrambler-supply-chain-attack
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-11
tags:
    - attack.initial-access
    - attack.t1195.001
    - attack.execution
    - attack.t1059.007
    - attack.persistence
    - attack.t1546.016
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\node.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_lifecycle:
        ParentCommandLine|contains:
            - 'npm install'
            - 'npm ci'
    filter_common:
        CommandLine|contains:
            - 'node-gyp'
            - 'electron-rebuild'
    condition: selection_parent and selection_child and selection_lifecycle and not filter_common
falsepositives:
    - Legitimate npm postinstall/build scripts compiling native addons (node-gyp, electron-rebuild)
level: high
```

**Known false positives:**

- Legitimate npm postinstall/build scripts that compile native addons (node-gyp, electron-rebuild, sharp)

**Tuning notes:** Baseline known-good packages that legitimately spawn native-build children during install (node-gyp, sharp, electron-rebuild) and exclude their package names from CommandLine matching; tighten to specific dist/setup.js or dist/intro.js filenames once the compromised package is identified in your environment.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- npm Registry Package Install Triggers Preinstall Hook Executing Unexpected Binary — Exploitation (locked: unlock with TL Creds)
- Newly-Installed Package Drops Packed/Obfuscated Native Binary with No Prior Signature — Post-Exploitation (locked: unlock with TL Creds)
- Post-Install Outbound Connection from node.exe/node Child-Process Tree to Unfamiliar Destination — C2/Exfil (locked: unlock with TL Creds)
- Sigma — npm preinstall Hook Spawns Command Shell from node.exe (locked: unlock with TL Creds)
- Sigma — Installer Package Lifecycle Hook Persistence via package.json preinstall/postinstall (locked: unlock with TL Creds)
- Sigma — Package Version Bump with Anomalous New Native Binary Payloads (SCA Signal) (locked: unlock with TL Creds)
- Platform-Detection Followed by Obfuscated/Packed Binary Execution Post-Install (locked: unlock with TL Creds)
- CI/Build Process Reads Credential-Shaped Environment Variables Immediately After npm Install (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [jscrambler npm Supply Chain Attack](https://socket.dev/blog/jscrambler-supply-chain-attack)
- [Reporting malware in an npm package](https://docs.npmjs.com/reporting-malware-in-an-npm-package/)
- [The npm Threat Landscape: Attack Surface and Mitigations](https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/)
- [Defending Against npm Supply Chain Attacks: A Practical Guide to Detection, Emulation, and Analysis](https://www.splunk.com/en_us/blog/security/npm-supply-chain-attack-detection-analysis.html)
- [Software supply chain attacks: check your dependencies](https://www.ncsc.gov.uk/blogs/software-supply-chain-attacks-check-your-dependencies)
- [npm v12 Ships This Month, Blocking Install Scripts That Enabled Year of Supply Chain Attacks](https://www.techtimes.com/articles/319890/20260708/npm-v12-ships-this-month-blocking-install-scripts-that-enabled-year-supply-chain-attacks.htm)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1233