Compromised jscrambler npm Package v8.14.0 Drops Rust Infostealer via Preinstall Hook

Key facts for jscrambler 8.14.0 Rust infostealer

Detection coverage for jscrambler 8.14.0 Rust infostealer

As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1238 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Outbound Exfiltration to jscrambler-Stealer C2 IPs or Telegram Bot API Post-Install

Detects outbound HTTPS to api.telegram.org from a non-messaging process (Windows exfil channel) or HTTP multipart/form-data POSTs to the documented jscrambler-stealer C2 IPs (Linux/macOS exfil channel), shortly after a package install — the C2/exfiltration stage of the attack chain.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1567, T1090.003, T1105
• Data sources: network_traffic, suricata, palo_alto_firewall, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=network sourcetype IN ("stream:http", "pan:traffic", "suricata")
(dest_ip="37.27.122.124" OR dest_ip="57.128.246.79" OR dest="api.telegram.org")
| eval process_name_lower=lower(process_name)
| where NOT like(process_name_lower, "%telegram%") OR isnull(process_name)
| eval reason="outbound connection to jscrambler-stealer C2 IP or Telegram Bot API from non-messaging process"
| table _time, src_ip, dest_ip, dest, dest_port, http_method, http_content_type, process_name, user, reason
| sort -_time

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where (RemoteIP in ("37.27.122.124", "57.128.246.79")) or (RemoteUrl has "api.telegram.org" and InitiatingProcessFileName !in~ ("telegram.exe", "Telegram.exe"))
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessAccountName
| order by Timestamp desc

Sigma

title: Outbound Connection to jscrambler-Stealer C2 IPs or Telegram Bot API From Non-Messaging Process
id: 8b6e6b6e-1a1e-4b1a-9b1a-jscrambler004
status: experimental
description: Detects network egress consistent with the jscrambler 8.14.0 infostealer exfiltration channels — hardcoded C2 IPs for Linux/macOS multipart HTTP POST, or the Telegram Bot API for Windows.
references:
    - https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html
    - https://safedep.io/ti/campaigns/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-11
tags:
    - attack.command_and_control
    - attack.exfiltration
    - attack.t1071.001
    - attack.t1567
    - attack.t1090.003
logsource:
    category: network_connection
    product: linux
detection:
    selection_c2_ip:
        DestinationIp:
            - '37.27.122.124'
            - '57.128.246.79'
    selection_telegram:
        DestinationHostname|contains: 'api.telegram.org'
    filter_telegram_client:
        Image|contains:
            - 'telegram'
            - 'Telegram'
    condition: selection_c2_ip or (selection_telegram and not filter_telegram_client)
falsepositives:
    - Legitimate Telegram desktop/mobile client traffic to api.telegram.org from an actual Telegram process
level: high

Known false positives:

• Legitimate Telegram desktop/mobile client sessions communicating with api.telegram.org from a genuine Telegram binary

Tuning notes: Correlate with a recent (within 1 hour) npm/node process spawn on the same host to reduce noise from unrelated Telegram usage; add DNS-layer detection for check.torproject.org / archive.torproject.org as a companion signal for the Tor-fallback path.

• 🔒 Developer Secret / Credential Store Enumeration Shortly After Package Install · unlock with TL Creds
• 🔒 Browser Credential Store / Crypto Wallet Extension File Access Post-Install · unlock with TL Creds
• 🔒 Anti-VM / Anti-Debug Reconnaissance Immediately Following npm Install · unlock with TL Creds
• 🔒 Unexpected eBPF Program Load (bpf() Syscall) From Non-Allowlisted Binary · unlock with TL Creds
• 🔒 macOS LaunchAgent Created and Loaded by Node/NPM Process Tree · unlock with TL Creds
• 🔒 Masqueraded/Obfuscated Loader Executing With Mismatched Extension-to-Content Type · unlock with TL Creds
• 🔒 npm Preinstall Lifecycle Script Spawning Process From Temp Directory · unlock with TL Creds
• 🔒 Suspicious Once-a-Minute Scheduled Task / LaunchAgent Created by npm/Node Install · unlock with TL Creds

Indicators of compromise for jscrambler 8.14.0 Rust infostealer

As of 2026-07-11, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-1238.

Sample indicators (3 of 17)

• IP address: 37.27.122[.]124
• Domain: check[.]torproject[.]org
• File hash: a742de963f14a92d24ebcbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

Community OSINT corroboration for jscrambler 8.14.0 Rust infostealer

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How jscrambler 8.14.0 Rust infostealer works

On 2026-07-11 the legitimate npm package `jscrambler` (a widely-used build-time JavaScript obfuscation/protection tool) received a new release, version 8.14.0, that differed from the prior clean release (8.13.0) by adding two new files under `dist/`: `setup.js`, a small JavaScript loader, and `intro.js`, a ~7.8MB binary container (despite its .js extension) packing three gzip-compressed native payloads — one build each for Windows, macOS, and Linux. The package's `preinstall` lifecycle hook was modified to invoke `setup.js` automatically during `npm install`, requiring no import, no CLI invocation, and no user interaction. On execution, the loader fingerprints the host OS/architecture, extracts the matching compressed payload to a randomly named file in the system temp directory, marks it executable, and downloads/launches a companion ~10.6MB Rust-compiled ELF/PE/Mach-O binary (approximately 976KB core stealer logic per platform-specific analysis) from a GitHub Releases-hosted URL as a detached child process, then removes itself.

The Rust binary is a full-featured infostealer targeting: 30+ cryptocurrency wallet extensions and desktop apps (MetaMask, Phantom, Exodus, and others), browser-stored credentials/cookies/history/autofill/payment cards across Chrome, Brave, Firefox, and Edge, cloud provider credentials and tokens (AWS, GCP, Azure, Kubernetes kubeconfig), SSH private keys, Discord, Telegram, Slack, and Steam session tokens, developer secrets (npm auth tokens, .env files, .npmrc, GitHub PATs, PyPI tokens), Bitwarden password-manager vault data, database client connection strings, and AI coding-assistant configuration/API keys (Claude Desktop, Cursor, Windsurf, VS Code, Zed).

Exfiltration differs by platform: the Windows build sends stolen data via the Telegram Bot API; the Linux and macOS builds POST multipart/form-data over HTTP to hardcoded C2 IPs, gated behind anti-VM/anti-debug checks that Windows lacks. Persistence is platform-specific: Windows installs a hidden Scheduled Task that relaunches the payload every minute; macOS installs a LaunchAgent that reloads on login; the Linux build links against the kernel BPF library to install an eBPF program for process/socket hiding, giving it rootkit-level concealment on hosts where it obtains sufficient privilege — such hosts cannot be reliably cleaned by conventional malware removal and warrant rebuild from clean media. Related campaign reporting also documents beaconing to Tor hidden services (with temp.sh as a fallback exfiltration channel) and self-propagation via abuse of npm OIDC Trusted Publishing in sibling incidents using the same tooling lineage.

Analysts found no matching commits in the jscrambler GitHub source repository corresponding to the malicious release, and the binaries were published to the npm registry under a legitimate, established maintainer account — indicating compromise of either the maintainer's npm publishing credentials/token or the package's CI/CD build pipeline rather than a source-code-level supply chain insertion. Socket.dev's automated scanning flagged the release approximately six minutes after publication; StepSecurity and SafeDep independently corroborated the payload analysis. The registry maintainers/publisher replaced the compromised release with a clean 8.15.0 version. Because jscrambler remains on the registry, projects with 8.14.0 pinned in lockfiles, or running npm clients older than npm 12 (which disabled preinstall/postinstall lifecycle scripts by default only three days prior, on 2026-07-08) remain at risk of re-triggering the payload on fresh installs.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Persistence

T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Initial Access

T1195 Supply Chain Compromise

Credential Access

T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Privilege Escalation

T1543 Create or Modify System Process

Resource Development

T1584 Compromise Infrastructure; T1586 Compromise Accounts

Impact

T1657 Financial Theft

Remediation for jscrambler 8.14.0 Rust infostealer

Patches

• jscrambler 8.15.0 (clean release superseding the compromised 8.14.0)

Immediate actions

• Remove jscrambler@8.14.0 from all package.json/lockfiles and clear npm/CI caches of the compromised tarball
• Update to jscrambler@8.15.0 or pin back to the last known-clean 8.13.0 until 8.15.0 is verified in your environment
• Audit CI/CD build logs and developer machine install history for any `npm install` of jscrambler between 2026-07-11 publication and detection
• Block outbound connections to identified C2 IPs 37.27.122.124 and 57.128.246.79 at perimeter/EDR
• Hunt for random-named executable files in OS temp directories and for the described persistence artifacts (Windows Scheduled Tasks, macOS LaunchAgents, Linux eBPF program loads via bpf() syscalls from unexpected binaries)

Workarounds

• Pin jscrambler to 8.13.0 (last verified clean release prior to 8.14.0) until 8.15.0 is independently verified
• Run installs with --ignore-scripts to prevent the preinstall hook from executing entirely

Longer-term hardening

• Upgrade to npm 12+ or equivalent tooling that disables preinstall/postinstall lifecycle scripts by default for third-party dependencies
• Enforce install-script allowlisting (e.g. pnpm's default lifecycle-script blocking, npm --ignore-scripts in CI) for all non-trusted packages
• Deploy Socket/SafeDep/StepSecurity-class registry-scanning in CI to catch malicious releases before they reach build environments
• Require SLSA/provenance attestation or Trusted Publishing verification for high-fanout build-tooling dependencies
• Segment CI/CD credentials so a single compromised build dependency cannot exfiltrate cloud, npm, and GitHub tokens in one run

Affected and fixed versions

• jscrambler — jscrambler (npm package)
  Vulnerable versions: 8.14.0
  Fixed in: 8.15.0; 8.13.0 (revert)

Timeline of jscrambler 8.14.0 Rust infostealer

• 2026-01-08 npm 12 released, disabling preinstall/postinstall lifecycle scripts by default for third-party packages — a mitigation that arrived days before this incident but does not protect projects on older npm clients or pinned lockfiles
• 2026-05-01 Mini Shai-Hulud worm compromises TanStack, Mistral AI, Guardrails AI, and other npm/PyPI packages using an infostealer/self-propagation lineage related to the tooling later seen in the locked-ioc-17 compromise
• 2026-06-01 Miasma supply-chain attack compromises Red Hat npm packages with a credential-stealing worm, and 145 Mastra npm packages are separately compromised via a hijacked contributor account — both part of the same wave of npm maintainer/contributor-account-abuse incidents preceding locked-ioc-17 8.14.0
• 2026-07-11 Projects with locked-ioc-17 8.14.0 pinned in lockfiles or running install-script-permissive npm clients remain at risk of re-triggering the payload on fresh installs, since the package version remains resolvable on the registry
• 2026-07-11 The Hacker News publishes public disclosure of the compromise with remediation guidance for downstream consumers
• 2026-07-11 Package maintainers/registry replace the compromised 8.14.0 release with a clean 8.15.0 version
• 2026-07-11 StepSecurity and SafeDep independently analyze the payload, confirming the Rust-based cross-platform infostealer, its persistence mechanisms, and exfiltration channels
• 2026-07-11 Socket.dev's automated scanning detects and flags the malicious release approximately six minutes after publication
• 2026-07-11 Malicious locked-ioc-17 8.14.0 published to the npm registry under a legitimate, established maintainer account, adding dist/setup.js and dist/intro.js and modifying the preinstall lifecycle hook

Sources cited for jscrambler 8.14.0 Rust infostealer

• jscrambler - Package Alerts - Socket.dev socket.dev · Vendor report · 2026-07-11
• SafeDep Threat Intelligence Campaigns safedep.io · Research · 2026-07-11
• pnpm 10.0.0 Blocks Lifecycle Scripts by Default socket.dev · Vendor report · 2026-01-01
• New Wave of Malicious npm Packages Delivering Infostealers Across Windows, Linux, and macOS lumificyber.com · Research · 2026-07-01
• jscrambler npm package page npmjs.com · Vendor report · 2026-07-11
• Compromised jscrambler 8.14.0 npm Release The Hacker News · News · 2026-07-11
• Infostealer campaign compromises 10 npm packages, targets devs BleepingComputer · News · 2026-01-01
• Infostealer for Windows, macOS and Linux found in ten packages on npm heise.de · News · 2026-01-01

Threats related to jscrambler 8.14.0 Rust infostealer

• Jscrambler npm Package Compromised: IronWorm Cross-Platform Infostealer (Shai-Hulud Lineage) via Rust Native Binaries
• jscrambler npm Package Supply Chain Compromise (v8.14.0 Malicious Release)

Previous and next in supply chain

• Counterfeit China-Made USB Drives with Self-Replicating Malware Infect 50+ Japan Ground Self-Defense Force Computers (Nikkei Investigation) Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages