Compromised jscrambler npm Package v8.14.0 Drops Rust Infostealer via Preinstall Hook — Threadlinqs Intelligence
As of 2026-07-11, Compromised jscrambler npm Package v8.14.0 Drops Rust Infostealer via Preinstall Hook is a critical-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-1238 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Version 8.14.0 of the jscrambler npm package (build-time JS obfuscation tool, ~15,800 weekly downloads) was published on 2026-07-11 with a malicious preinstall hook that silently drops and runs a
On 2026-07-11 the legitimate npm package `jscrambler` (a widely-used build-time JavaScript obfuscation/protection tool) received a new release, version 8.14.0, that differed from the prior clean release (8.13.0) by adding two new files under `dist/`: `setup.js`, a small JavaScript loader, and `intro.js`, a ~7.8MB binary container (despite its .js extension) packing three gzip-compressed native payloads — one build each for Windows, macOS, and Linux. The package's `preinstall` lifecycle hook was modified to invoke `setup.js` automatically during `npm install`, requiring no import, no CLI invocation, and no user interaction. On execution, the loader fingerprints the host OS/architecture, extracts the matching compressed payload to a randomly named file in the system temp directory, marks it executable, and downloads/launches a companion ~10.6MB Rust-compiled ELF/PE/Mach-O binary (approximately 976KB core stealer logic per platform-specific analysis) from a GitHub Releases-hosted URL as a detached child process, then removes itself.
The Rust binary is a full-featured infostealer targeting: 30+ cryptocurrency wallet extensions and desktop apps (MetaMask, Phantom, Exodus, and others), browser-stored credentials/cookies/history/autofill/payment cards across Chrome, Brave, Firefox, and Edge, cloud provider credentials and tokens (AWS, GCP, Azure, Kubernetes kubeconfig), SSH private keys, Discord, Telegram, Slack, and Steam session tokens, developer secrets (npm auth tokens, .env files, .npmrc, GitHub PATs, PyPI tokens), Bitwarden password-manager vault data, database client connection strings, and AI coding-assistant configuration/API keys (Claude Desktop, Cursor, Windsurf, VS Code, Zed).
Exfiltration differs by platform: the Windows build sends stolen data via the Telegram Bot API; the Linux and macOS builds POST multipart/form-data over HTTP to hardcoded C2 IPs, gated behind anti-VM/anti-debug checks that Windows lacks. Persistence is platform-specific: Windows installs a hidden Scheduled Task that relaunches the payload every minute; macOS installs a LaunchAgent that reloads on login; the Linux build links against the kernel BPF library to install an eBPF program for process/socket hiding, giving it rootkit-level concealment on hosts where it obtains sufficient privilege — such hosts cannot be reliably cleaned by conventional malware removal and warrant rebuild from clean media. Related campaign reporting also documents beaconing to Tor hidden services (with temp.sh as a fallback exfiltration channel) and self-propagation via abuse of npm OIDC Trusted Publishing in sibling incidents using the same tooling lineage.
Analysts found no matching commits in the jscrambler GitHub source repository corresponding to the malicious release, and the binaries were published to the npm registry under a legitimate, established maintainer account — indicating compromise of either the maintainer's npm publishing credentials/token or the package's CI/CD build pipeline rather than a source-code-level supply chain insertion. Socket.dev's automated scanning flagged the release approximately six minutes after publication; StepSecurity and SafeDep independently corroborated the payload analysis. The registry maintainers/publisher replaced the compromised release with a clean 8.15.0 version. Because jscrambler remains on the registry, projects with 8.14.0 pinned in lockfiles, or running npm clients older than npm 12 (which disabled preinstall/postinstall lifecycle scripts by default only three days prior, on 2026-07-08) remain at risk of re-triggering the payload on fresh installs.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-798
Target sectors: technology, software-development, cloud-services, cryptocurrency
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1586, T1584, T1195, T1195, T1204, T1059, T1106, T1053, T1543, T1547