Compromised jscrambler npm Package v8.14.0 Drops Rust Infostealer via Preinstall Hook

Compromised jscrambler npm Package v8.14.0 Drops Rust (TL-2026-1238), also tracked as jscrambler npm supply chain attack, is a critical-severity supply-chain compromise, first published 2026-07-11. It has no confirmed attribution, affects jscrambler jscrambler (npm package), maps to 30 MITRE ATT&CK techniques (T1005, T1014, T1027), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-1238

Threat ID
TL-2026-1238
Also known as
jscrambler npm supply chain attack, jscrambler 8.14.0 infostealer
Severity
CRITICAL
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-07-11
Last reviewed
2026-07-11
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, software-development, cloud-services, cryptocurrency
Target regions
Global
Detection rules
9
Indicators of compromise
17

Malware and tooling in Compromised jscrambler npm Package v8.14.0 Drops Rust

Malware and tooling: jscrambler-preinstall-stealer, Telegram Bot API used as exfiltration channel

Version 8.14.0 of the jscrambler npm package (build-time JS obfuscation tool, ~15,800 weekly downloads) was published on 2026-07-11 with a malicious preinstall hook that silently drops and runs a Rust-based, multi-platform infostealer. Socket detected the release six minutes after publication; the package was replaced with a clean 8.15.0 build shortly after.

How Compromised jscrambler npm Package v8.14.0 Drops Rust works

On 2026-07-11 the legitimate npm package `jscrambler` (a widely-used build-time JavaScript obfuscation/protection tool) received a new release, version 8.14.0, that differed from the prior clean release (8.13.0) by adding two new files under `dist/`: `setup.js`, a small JavaScript loader, and `intro.js`, a ~7.8MB binary container (despite its .js extension) packing three gzip-compressed native payloads — one build each for Windows, macOS, and Linux. The package's `preinstall` lifecycle hook was modified to invoke `setup.js` automatically during `npm install`, requiring no import, no CLI invocation, and no user interaction. On execution, the loader fingerprints the host OS/architecture, extracts the matching compressed payload to a randomly named file in the system temp directory, marks it executable, and downloads/launches a companion ~10.6MB Rust-compiled ELF/PE/Mach-O binary (approximately 976KB core stealer logic per platform-specific analysis) from a GitHub Releases-hosted URL as a detached child process, then removes itself.

The Rust binary is a full-featured infostealer targeting: 30+ cryptocurrency wallet extensions and desktop apps (MetaMask, Phantom, Exodus, and others), browser-stored credentials/cookies/history/autofill/payment cards across Chrome, Brave, Firefox, and Edge, cloud provider credentials and tokens (AWS, GCP, Azure, Kubernetes kubeconfig), SSH private keys, Discord, Telegram, Slack, and Steam session tokens, developer secrets (npm auth tokens, .env files, .npmrc, GitHub PATs, PyPI tokens), Bitwarden password-manager vault data, database client connection strings, and AI coding-assistant configuration/API keys (Claude Desktop, Cursor, Windsurf, VS Code, Zed).

Exfiltration differs by platform: the Windows build sends stolen data via the Telegram Bot API; the Linux and macOS builds POST multipart/form-data over HTTP to hardcoded C2 IPs, gated behind anti-VM/anti-debug checks that Windows lacks. Persistence is platform-specific: Windows installs a hidden Scheduled Task that relaunches the payload every minute; macOS installs a LaunchAgent that reloads on login; the Linux build links against the kernel BPF library to install an eBPF program for process/socket hiding, giving it rootkit-level concealment on hosts where it obtains sufficient privilege — such hosts cannot be reliably cleaned by conventional malware removal and warrant rebuild from clean media. Related campaign reporting also documents beaconing to Tor hidden services (with temp.sh as a fallback exfiltration channel) and self-propagation via abuse of npm OIDC Trusted Publishing in sibling incidents using the same tooling lineage.

Analysts found no matching commits in the jscrambler GitHub source repository corresponding to the malicious release, and the binaries were published to the npm registry under a legitimate, established maintainer account — indicating compromise of either the maintainer's npm publishing credentials/token or the package's CI/CD build pipeline rather than a source-code-level supply chain insertion. Socket.dev's automated scanning flagged the release approximately six minutes after publication; StepSecurity and SafeDep independently corroborated the payload analysis. The registry maintainers/publisher replaced the compromised release with a clean 8.15.0 version. Because jscrambler remains on the registry, projects with 8.14.0 pinned in lockfiles, or running npm clients older than npm 12 (which disabled preinstall/postinstall lifecycle scripts by default only three days prior, on 2026-07-08) remain at risk of re-triggering the payload on fresh installs.

MITRE ATT&CK techniques used in TL-2026-1238

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Persistence

T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Initial Access

T1195 Supply Chain Compromise

Credential Access

T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Privilege Escalation

T1543 Create or Modify System Process

Resource Development

T1584 Compromise Infrastructure; T1586 Compromise Accounts

Impact

T1657 Financial Theft

Affected products and versions in Compromised jscrambler npm Package v8.14.0 Drops Rust

  • jscrambler — jscrambler (npm package)
    Vulnerable versions: 8.14.0
    Fixed in: 8.15.0; 8.13.0 (revert)

Remediation for Compromised jscrambler npm Package v8.14.0 Drops Rust

Patches

  • jscrambler 8.15.0 (clean release superseding the compromised 8.14.0)

Immediate actions

  • Remove jscrambler@8.14.0 from all package.json/lockfiles and clear npm/CI caches of the compromised tarball
  • Update to jscrambler@8.15.0 or pin back to the last known-clean 8.13.0 until 8.15.0 is verified in your environment
  • Audit CI/CD build logs and developer machine install history for any `npm install` of jscrambler between 2026-07-11 publication and detection
  • Block outbound connections to identified C2 IPs 37.27.122.124 and 57.128.246.79 at perimeter/EDR
  • Hunt for random-named executable files in OS temp directories and for the described persistence artifacts (Windows Scheduled Tasks, macOS LaunchAgents, Linux eBPF program loads via bpf() syscalls from unexpected binaries)

Workarounds

  • Pin jscrambler to 8.13.0 (last verified clean release prior to 8.14.0) until 8.15.0 is independently verified
  • Run installs with --ignore-scripts to prevent the preinstall hook from executing entirely

Longer-term hardening

  • Upgrade to npm 12+ or equivalent tooling that disables preinstall/postinstall lifecycle scripts by default for third-party dependencies
  • Enforce install-script allowlisting (e.g. pnpm's default lifecycle-script blocking, npm --ignore-scripts in CI) for all non-trusted packages
  • Deploy Socket/SafeDep/StepSecurity-class registry-scanning in CI to catch malicious releases before they reach build environments
  • Require SLSA/provenance attestation or Trusted Publishing verification for high-fanout build-tooling dependencies
  • Segment CI/CD credentials so a single compromised build dependency cannot exfiltrate cloud, npm, and GitHub tokens in one run

Weaknesses (CWE) in Compromised jscrambler npm Package v8.14.0 Drops Rust

CWE-506, CWE-829, CWE-494, CWE-798

Timeline of Compromised jscrambler npm Package v8.14.0 Drops Rust

  • npm 12 released, disabling preinstall/postinstall lifecycle scripts by default for third-party packages — a mitigation that arrived days before this incident but does not protect projects on older npm clients or pinned lockfiles
  • Mini Shai-Hulud worm compromises TanStack, Mistral AI, Guardrails AI, and other npm/PyPI packages using an infostealer/self-propagation lineage related to the tooling later seen in the jscrambler compromise
  • Miasma supply-chain attack compromises Red Hat npm packages with a credential-stealing worm, and 145 Mastra npm packages are separately compromised via a hijacked contributor account — both part of the same wave of npm maintainer/contributor-account-abuse incidents preceding jscrambler 8.14.0
  • Projects with jscrambler 8.14.0 pinned in lockfiles or running install-script-permissive npm clients remain at risk of re-triggering the payload on fresh installs, since the package version remains resolvable on the registry
  • The Hacker News publishes public disclosure of the compromise with remediation guidance for downstream consumers
  • Package maintainers/registry replace the compromised 8.14.0 release with a clean 8.15.0 version
  • StepSecurity and SafeDep independently analyze the payload, confirming the Rust-based cross-platform infostealer, its persistence mechanisms, and exfiltration channels
  • Socket.dev's automated scanning detects and flags the malicious release approximately six minutes after publication
  • Malicious jscrambler 8.14.0 published to the npm registry under a legitimate, established maintainer account, adding dist/setup.js and dist/intro.js and modifying the preinstall lifecycle hook

Sources cited for Compromised jscrambler npm Package v8.14.0 Drops Rust

Threats related to Compromised jscrambler npm Package v8.14.0 Drops Rust

Detection coverage for TL-2026-1238

As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1238 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1238

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats