# Compromised jscrambler npm Package v8.14.0 Drops Rust Infostealer via Preinstall Hook

> Version 8.14.0 of the jscrambler npm package (build-time JS obfuscation tool, ~15,800 weekly downloads) was published on 2026-07-11 with a malicious preinstall hook that silently drops and runs a Rust-based, multi-platform infostealer. Socket detected the release six minutes after publication; the package was replaced with a clean 8.15.0 build shortly after.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1238
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-jscrambler-8-14-0-rust-infostealer-tl-2026-1238.webp?v=39641ca4 (Threadlinqs threat intel: jscrambler npm 8.14.0 Rust Infostealer: Detection & IOCs (TL-2026-1238) — Critical severity, 17 IOCs, 9 detection rules.)
- **ID:** TL-2026-1238
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)

## Description

On 2026-07-11 the legitimate npm package `jscrambler` (a widely-used build-time JavaScript obfuscation/protection tool) received a new release, version 8.14.0, that differed from the prior clean release (8.13.0) by adding two new files under `dist/`: `setup.js`, a small JavaScript loader, and `intro.js`, a ~7.8MB binary container (despite its .js extension) packing three gzip-compressed native payloads — one build each for Windows, macOS, and Linux. The package's `preinstall` lifecycle hook was modified to invoke `setup.js` automatically during `npm install`, requiring no import, no CLI invocation, and no user interaction. On execution, the loader fingerprints the host OS/architecture, extracts the matching compressed payload to a randomly named file in the system temp directory, marks it executable, and downloads/launches a companion ~10.6MB Rust-compiled ELF/PE/Mach-O binary (approximately 976KB core stealer logic per platform-specific analysis) from a GitHub Releases-hosted URL as a detached child process, then removes itself.

The Rust binary is a full-featured infostealer targeting: 30+ cryptocurrency wallet extensions and desktop apps (MetaMask, Phantom, Exodus, and others), browser-stored credentials/cookies/history/autofill/payment cards across Chrome, Brave, Firefox, and Edge, cloud provider credentials and tokens (AWS, GCP, Azure, Kubernetes kubeconfig), SSH private keys, Discord, Telegram, Slack, and Steam session tokens, developer secrets (npm auth tokens, .env files, .npmrc, GitHub PATs, PyPI tokens), Bitwarden password-manager vault data, database client connection strings, and AI coding-assistant configuration/API keys (Claude Desktop, Cursor, Windsurf, VS Code, Zed).

Exfiltration differs by platform: the Windows build sends stolen data via the Telegram Bot API; the Linux and macOS builds POST multipart/form-data over HTTP to hardcoded C2 IPs, gated behind anti-VM/anti-debug checks that Windows lacks. Persistence is platform-specific: Windows installs a hidden Scheduled Task that relaunches the payload every minute; macOS installs a LaunchAgent that reloads on login; the Linux build links against the kernel BPF library to install an eBPF program for process/socket hiding, giving it rootkit-level concealment on hosts where it obtains sufficient privilege — such hosts cannot be reliably cleaned by conventional malware removal and warrant rebuild from clean media. Related campaign reporting also documents beaconing to Tor hidden services (with temp.sh as a fallback exfiltration channel) and self-propagation via abuse of npm OIDC Trusted Publishing in sibling incidents using the same tooling lineage.

Analysts found no matching commits in the jscrambler GitHub source repository corresponding to the malicious release, and the binaries were published to the npm registry under a legitimate, established maintainer account — indicating compromise of either the maintainer's npm publishing credentials/token or the package's CI/CD build pipeline rather than a source-code-level supply chain insertion. Socket.dev's automated scanning flagged the release approximately six minutes after publication; StepSecurity and SafeDep independently corroborated the payload analysis. The registry maintainers/publisher replaced the compromised release with a clean 8.15.0 version. Because jscrambler remains on the registry, projects with 8.14.0 pinned in lockfiles, or running npm clients older than npm 12 (which disabled preinstall/postinstall lifecycle scripts by default only three days prior, on 2026-07-08) remain at risk of re-triggering the payload on fresh installs.

## MITRE ATT&CK

- T1586 Compromise Accounts
- T1584 Compromise Infrastructure
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1014 Rootkit
- T1497 Virtualization/Sandbox Evasion
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1036 Masquerading
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1102 Web Service
- T1090 Proxy
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Outbound Exfiltration to jscrambler-Stealer C2 IPs or Telegram Bot API Post-Install** (`TL-2026-1238-SPL-003`)

Detects outbound HTTPS to api.telegram.org from a non-messaging process (Windows exfil channel) or HTTP multipart/form-data POSTs to the documented jscrambler-stealer C2 IPs (Linux/macOS exfil channel), shortly after a package install — the C2/exfiltration stage of the attack chain.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1567, T1090.003, T1105
- **Data sources:** network_traffic, suricata, palo_alto_firewall, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype IN ("stream:http", "pan:traffic", "suricata")
(dest_ip="37.27.122.124" OR dest_ip="57.128.246.79" OR dest="api.telegram.org")
| eval process_name_lower=lower(process_name)
| where NOT like(process_name_lower, "%telegram%") OR isnull(process_name)
| eval reason="outbound connection to jscrambler-stealer C2 IP or Telegram Bot API from non-messaging process"
| table _time, src_ip, dest_ip, dest, dest_port, http_method, http_content_type, process_name, user, reason
| sort -_time
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where (RemoteIP in ("37.27.122.124", "57.128.246.79")) or (RemoteUrl has "api.telegram.org" and InitiatingProcessFileName !in~ ("telegram.exe", "Telegram.exe"))
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessAccountName
| order by Timestamp desc
```

### Sigma

```yaml
title: Outbound Connection to jscrambler-Stealer C2 IPs or Telegram Bot API From Non-Messaging Process
id: 8b6e6b6e-1a1e-4b1a-9b1a-jscrambler004
status: experimental
description: Detects network egress consistent with the jscrambler 8.14.0 infostealer exfiltration channels — hardcoded C2 IPs for Linux/macOS multipart HTTP POST, or the Telegram Bot API for Windows.
references:
    - https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html
    - https://safedep.io/ti/campaigns/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-11
tags:
    - attack.command_and_control
    - attack.exfiltration
    - attack.t1071.001
    - attack.t1567
    - attack.t1090.003
logsource:
    category: network_connection
    product: linux
detection:
    selection_c2_ip:
        DestinationIp:
            - '37.27.122.124'
            - '57.128.246.79'
    selection_telegram:
        DestinationHostname|contains: 'api.telegram.org'
    filter_telegram_client:
        Image|contains:
            - 'telegram'
            - 'Telegram'
    condition: selection_c2_ip or (selection_telegram and not filter_telegram_client)
falsepositives:
    - Legitimate Telegram desktop/mobile client traffic to api.telegram.org from an actual Telegram process
level: high
```

**Known false positives:**

- Legitimate Telegram desktop/mobile client sessions communicating with api.telegram.org from a genuine Telegram binary

**Tuning notes:** Correlate with a recent (within 1 hour) npm/node process spawn on the same host to reduce noise from unrelated Telegram usage; add DNS-layer detection for check.torproject.org / archive.torproject.org as a companion signal for the Tor-fallback path.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Developer Secret / Credential Store Enumeration Shortly After Package Install (locked: unlock with TL Creds)
- Browser Credential Store / Crypto Wallet Extension File Access Post-Install (locked: unlock with TL Creds)
- Anti-VM / Anti-Debug Reconnaissance Immediately Following npm Install (locked: unlock with TL Creds)
- Unexpected eBPF Program Load (bpf() Syscall) From Non-Allowlisted Binary (locked: unlock with TL Creds)
- macOS LaunchAgent Created and Loaded by Node/NPM Process Tree (locked: unlock with TL Creds)
- Masqueraded/Obfuscated Loader Executing With Mismatched Extension-to-Content Type (locked: unlock with TL Creds)
- npm Preinstall Lifecycle Script Spawning Process From Temp Directory (locked: unlock with TL Creds)
- Suspicious Once-a-Minute Scheduled Task / LaunchAgent Created by npm/Node Install (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- IP address: `37.27.122[.]124`
- Domain: `check[.]torproject[.]org`
- File hash: `a742de963f14a92d24ebcbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Compromised jscrambler 8.14.0 npm Release](https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html)
- [jscrambler - Package Alerts - Socket.dev](https://socket.dev/npm/package/jscrambler/alerts/6.4.28)
- [SafeDep Threat Intelligence Campaigns](https://safedep.io/ti/campaigns/)
- [pnpm 10.0.0 Blocks Lifecycle Scripts by Default](https://socket.dev/blog/pnpm-10-0-0-blocks-lifecycle-scripts-by-default)
- [New Wave of Malicious npm Packages Delivering Infostealers Across Windows, Linux, and macOS](https://www.lumificyber.com/threat-library/npm-infostealers/)
- [Infostealer campaign compromises 10 npm packages, targets devs](https://www.bleepingcomputer.com/news/security/infostealer-campaign-compromises-10-npm-packages-targets-devs/)
- [Infostealer for Windows, macOS and Linux found in ten packages on npm](https://www.heise.de/en/news/Infostealer-for-Windows-macOS-and-Linux-found-in-ten-packages-on-npm-10964203.html)
- [jscrambler npm package page](https://www.npmjs.com/package/jscrambler)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1238