Jscrambler npm Package Compromised: IronWorm Cross-Platform Infostealer (Shai-Hulud Lineage) via Rust Native Binaries

Key facts for IronWorm Jscrambler npm compromise

Detection coverage for IronWorm Jscrambler npm compromise

As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1379 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Data exfiltration to temp.sh or Tor-adjacent infrastructure from developer/CI host

Detects outbound HTTPS traffic to temp.sh (IronWorm's primary exfiltration channel for compressed/encrypted stolen data) or DNS/connection attempts to check.torproject.org, archive.torproject.org, or the associated IPs 37.27.122.124 / 57.128.246.79 from a developer workstation or CI/CD build host.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1567, T1071.001, T1090.003, T1102, T1041
• Data sources: network_stream_dns, network_stream_http, firewall_logs, microsoft_defender_devicenetworkevents
• Severity: critical
• Confidence: high

Splunk SPL

index=network (sourcetype="stream:dns" OR sourcetype="stream:http" OR sourcetype="pan:traffic")
| where match(query, "(?i)(temp\.sh|check\.torproject\.org|archive\.torproject\.org)") OR dest_ip IN ("37.27.122.124", "57.128.246.79") OR match(dest, "(?i)temp\.sh")
| eval risk_reason="Outbound connection to IronWorm exfil/Tor-adjacent infrastructure"
| table _time, host, src_ip, dest_ip, dest, query, risk_reason
| sort -_time

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has "temp.sh" or RemoteUrl has_any ("check.torproject.org", "archive.torproject.org") or RemoteIP in ("37.27.122.124", "57.128.246.79")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc

Sigma

title: Outbound Connection to temp.sh or Tor-Adjacent Infrastructure from Developer Host
id: 4c6e0a1f-8b25-4a7c-9e0f-5d2a4c8b7f11
status: experimental
description: Detects outbound connections from a developer or CI/CD host to temp.sh (IronWorm's primary bulk-data exfiltration channel), or to Tor Project reachability-check infrastructure (check.torproject.org, archive.torproject.org, 37.27.122.124, 57.128.246.79) observed alongside the Jscrambler/IronWorm supply-chain campaign.
references:
    - https://www.stepsecurity.io/blog/jscrambler-npm-package-publishes-malicious-preinstall-binary
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-15
tags:
    - attack.exfiltration
    - attack.command_and_control
    - attack.t1567
    - attack.t1071.001
    - attack.t1090.003
    - attack.t1102
    - attack.tool.ironworm
    - attack.tool.shai_hulud
logsource:
    category: network_connection
detection:
    selection:
        DestinationHostname|contains:
            - 'temp.sh'
            - 'check.torproject.org'
            - 'archive.torproject.org'
        DestinationIp:
            - '37.27.122.124'
            - '57.128.246.79'
    condition: selection
falsepositives:
    - Security researchers or privacy-conscious developers intentionally using temp.sh or the Tor Browser on a sanctioned workstation
level: critical

Known false positives:

• Sanctioned security research or privacy tooling on an authorized workstation that legitimately uses temp.sh or Tor

Tuning notes: Maintain an allowlist for any sanctioned security-research hosts that use Tor or temp.sh legitimately; correlate with TL-2026-1379-SPL-001/002 process-tree evidence to raise confidence before triggering incident response.

• 🔒 jscrambler malicious version install followed by native binary write in temp · unlock with TL Creds
• 🔒 Bulk credential-store file access by Node.js-spawned or unrelated child process · unlock with TL Creds
• 🔒 npm token-hunting and self-propagation into other high-download packages · unlock with TL Creds
• 🔒 IronWorm Cross-Platform Payload Anti-Debug / Sandbox Evasion Check · unlock with TL Creds
• 🔒 Cloud Instance Metadata Endpoint Queried by Node.js Process · unlock with TL Creds
• 🔒 Linux eBPF Kernel Module Loaded via libbpf.so.1 by Node.js-Spawned Process · unlock with TL Creds
• 🔒 npm postinstall/require-time IronWorm dropper spawning detached hidden process · unlock with TL Creds
• 🔒 IronWorm OS-specific persistence — hidden Scheduled Task, LaunchAgent, or eBPF load · unlock with TL Creds

Indicators of compromise for IronWorm Jscrambler npm compromise

As of 2026-11-01, Threadlinqs Intelligence tracks 31 indicators of compromise for TL-2026-1379.

Sample indicators (3 of 31)

• IP address: 37.27.122[.]124
• Domain: check[.]torproject[.]org
• File hash: a742de963f14a92d24ebcbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60

Defanged, TLP:CLEAR. Full set of 31 indicators: unlock with TL Creds.

Community OSINT corroboration for IronWorm Jscrambler npm compromise

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How IronWorm Jscrambler npm compromise works

The malware harvests browser, cloud (AWS/Azure/GCP), cryptocurrency, password-manager, communications, AI-dev-tool, and Steam credentials, establishes OS-specific persistence, and exfiltrates data to temp.sh and observed Tor infrastructure, while also hunting for additional npm tokens to self-propagate into other high-download packages.

On July 11, 2026, an attacker leveraging a compromised npm publishing credential belonging to Jscrambler (a commercial JavaScript obfuscation and application-security vendor) published version 8.14.0 of the `jscrambler` npm package containing an undocumented `preinstall` script pointing to `dist/setup.js`. This loader reads a 7.8 MB container file (`dist/intro.js`, magic header `1B 43 53 49 01`) holding three gzip-compressed, platform-specific native executables (Linux ELF, Windows PE32+, macOS Mach-O arm64). The loader decompresses the binary matching the host OS, writes it to a randomly named file in the temp directory, and spawns it detached with `stdio: 'ignore'` and `windowsHide: true`, requiring no further user interaction beyond `npm install`.

Socket's automated scanning flagged the package roughly six minutes after publication, but the attacker continued publishing malicious releases across a roughly three-hour window: 8.16.0 and 8.17.0 retained the preinstall-hook delivery, while 8.18.0 and 8.20.0 moved the dropper logic into a self-executing function injected at the top of `dist/index.js` and `dist/bin/jscrambler.js`, triggering on `require()`/import or CLI invocation. This evolution specifically defeated `npm install --ignore-scripts` and npm 12's July 8, 2026 default of disabling install scripts, since execution no longer depended on any lifecycle script.

JFrog's subsequent malware analysis identified the compiled payload as **IronWorm**, a Rust-based infostealer first documented roughly one month prior and linked to the **Shai-Hulud** worm lineage of npm supply-chain malware. IronWorm is a full-featured credential harvester: it targets browser-stored passwords/cookies/sessions (Chrome, Firefox, Edge) via embedded SQLite/LevelDB parsers; cryptocurrency wallets and seed phrases (MetaMask, Trust Wallet, Coinbase Wallet, Phantom, Exodus) using scrypt-based vault decryption attempts and an embedded BIP39 English wordlist for seed-phrase identification; password manager vaults (Bitwarden); cloud provider credentials via AWS ECS task metadata endpoints, Azure IMDS, and GCP metadata tokens, plus associated Secrets Manager/Parameter Store access; communications app sessions (Discord, Slack, Telegram) and Steam session data; AI developer tool configuration files (Claude Desktop, Cursor, Windsurf, VS Code, Zed) that store API keys and Model Context Protocol (MCP) server credentials; and VPN configuration files.

The malware establishes OS-specific persistence: a hidden Windows Scheduled Task that relaunches the payload every minute; a macOS LaunchAgent that reloads on user login; and on Linux, dynamic loading of eBPF programs via `libbpf.so.1` for kernel-level instrumentation and sustained access. Anti-analysis features include `IsDebuggerPresent` and `GetExtendedTcpTable`-based process enumeration on Windows and `sysctl`-based debugger detection on macOS.

Harvested data is compressed and encrypted, then exfiltrated primarily via direct HTTPS upload to `temp.sh`, a public anonymous file-hosting service, avoiding the need for attacker-controlled C2 infrastructure for the bulk-data channel. Independent network monitoring (StepSecurity Harden-Runner) additionally observed outbound connections from infected hosts to Tor Project infrastructure (`check.torproject.org`, `archive.torproject.org`, and associated IPs `37.27.122.124` and `57.128.246.79`), consistent with either connectivity/reachability checks for a Tor-routed secondary exfiltration path or anti-analysis network fingerprinting; independent confirmation of a full Tor exfiltration channel remains unverified per source reporting.

Consistent with the Shai-Hulud worm lineage, IronWorm also actively hunts infected developer machines for additional valid npm publishing tokens, which it uses to self-propagate by injecting malicious `setup.mjs`-style dropper scripts into other high-download npm packages the compromised developer has publish rights to — giving the campaign worm-like supply-chain spread potential beyond the initial Jscrambler compromise.

Jscrambler's weekly download count of roughly 15,800 limited but did not eliminate blast radius; npm's platform-level telemetry initially reported near-zero installs of the malicious versions pending verification. Jscrambler revoked and rotated its publishing credentials and related secrets and deprecated the affected releases; clean releases resume at 8.22.0 (last known-clean pre-compromise version was 8.13.0, published June 30, 2026).

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1074 Data Staged; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1202 Indirect Command Execution; T1497.001 System Checks; T1564.001 Hide Artifacts; T1622 Debugger Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Discovery

T1049 System Network Connections Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1526 Cloud Service Discovery

Persistence

T1053.005 Scheduled Task; T1543.001 Launch Agent; T1547.006 Kernel Modules and Extensions

Privilege Escalation

T1053.005 Scheduled Task

Execution

T1059.007 JavaScript; T1106 Native API; T1204 User Execution

Command and Control

T1071.001 Web Protocols; T1090.003 Multi-hop Proxy; T1102 Web Service

Initial Access

T1078 Valid Accounts; T1195.002 Compromise Software Supply Chain

initial-access

T1195.002 Compromise Software Supply Chain

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1552.005 Cloud Instance Metadata API; T1555.003 Credentials from Web Browsers; T1555.005 Password Managers

Resource Development

T1586 Compromise Accounts

Impact

T1657 Financial Theft

Remediation for IronWorm Jscrambler npm compromise

Patches

• Upgrade jscrambler to 8.22.0 or later

Immediate actions

• Remove jscrambler versions 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0 from package.json, lockfiles, and local npm caches on all developer and CI/CD machines
• Upgrade to jscrambler@8.22.0 (confirmed clean) or pin to the last known-clean 8.13.0
• Treat any machine that installed an affected version as fully compromised
• Blacklist C2 IPs 37.27.122.124 and 57.128.246.79 at the network perimeter and monitor for outbound connections to check.torproject.org / archive.torproject.org
• Block or alert on outbound uploads to temp.sh from developer and build endpoints

Workarounds

• Pin jscrambler to 8.13.0 until 8.22.0 is verified in your environment
• Run npm install with --ignore-scripts as defense-in-depth (note: does NOT stop the require()-time dropper in 8.18.0/8.20.0, so must be paired with version pinning)

Longer-term hardening

• Enforce npm install-script allowlisting / disable lifecycle scripts by default (npm 12 default) across all engineering and CI/CD environments
• Adopt supply-chain scanning (Socket, StepSecurity Harden-Runner, JFrog Xray or equivalent) on all package installs
• Require signed/attested npm publishes and hardware-token-backed publishing credentials for maintainers of widely-depended packages
• Deploy EDR with eBPF-aware behavioral detection on Linux build/dev hosts to catch kernel-level instrumentation techniques

Affected and fixed versions

• Jscrambler — jscrambler (npm package)
  Vulnerable versions: 8.14.0; 8.16.0; 8.17.0; 8.18.0; 8.20.0
  Fixed in: 8.22.0

Timeline of IronWorm Jscrambler npm compromise

Last updated 2026-11-01 · revalidated 1× · latest source

• 2026-06-30 locked-ioc-28 8.13.0 published — the last verified clean version before the compromise.
• 2026-07-08 npm 12 ships with install scripts disabled by default, a defense the attacker's later require()-time payload was specifically engineered to bypass.
• 2026-07-11 locked-ioc-28 reports 1,479 downloads of the malicious versions before deprecation; versions were deprecated rather than removed, so exact-version or lockfile installs still resolve.
• 2026-07-11 StepSecurity Harden-Runner observes outbound connections from compromised hosts to Tor Project infrastructure (locked-ioc-18, locked-ioc-15, IPs locked-ioc-24 and locked-ioc-25); endpoints are added to StepSecurity's global block list.
• 2026-07-11 Over a roughly three-hour window (through 17:53 UTC) the attacker publishes four additional malicious versions — 8.16.0, 8.17.0, 8.18.0, 8.20.0 — with 8.18.0 and 8.20.0 moving the dropper from the preinstall hook into a self-executing function in dist/index.js and dist/bin/locked-ioc-28.js to survive --ignore-scripts.
• 2026-07-11 Socket's automated scanning flags locked-ioc-28 8.14.0 as malicious approximately six minutes after publication.
• 2026-07-11 Attacker publishes malicious locked-ioc-28 8.14.0 at 15:12 UTC using a stolen npm publishing credential; the release contains a preinstall hook (dist/setup.js) that drops and executes a platform-specific native infostealer binary.
• 2026-07-13 Bleeping Computer and The Hacker News publish public coverage of the compromise, widening awareness beyond the initial security-vendor detections.
• 2026-07-14 SecurityWeek reports downstream wrappers jscrambler-webpack-plugin 8.6.2, gulp-jscrambler 8.6.2, grunt-jscrambler 8.5.2 and jscrambler-metro-plugin 9.0.2 also affected.
• 2026-07-14 locked-ioc-28 revokes and rotates its compromised npm publishing credentials and related secrets, deprecates the five malicious releases, and adds additional publishing-pipeline controls.
• 2026-07-14 JFrog malware analysis identifies the payload as locked-ioc-30, a Rust-based infostealer documented roughly one month earlier and linked to the locked-ioc-27 npm worm lineage, including self-propagation via stolen npm tokens.
• 2026-07-15 locked-ioc-28 8.22.0 is published and confirmed clean; developers are urged to upgrade or pin back to 8.13.0 and rotate all credentials exposed on affected machines.

Update history

• 2026-11-01 — locked-ioc-28 npm Package Compromised in Supply Chain Attack - locked-ioc-30 Rust Infostealer Dropper (Versions 8.14.0-8.20.0): What changed No severity, exploitability or status change (both remain HIGH / ACTIVE). Scope widened: four downstream locked-ioc-28 wrapper plugins reported affected and 1,479 downloads of malicious versions reported. New indicators (6) Ind

Sources cited for IronWorm Jscrambler npm compromise

• Jscrambler npm Package Compromised in Supply Chain Attack Wiz · Advisory · 2026-07-11
• Jscrambler npm package publishes malicious preinstall binary stepsecurity.io · Blog · 2026-07-11
• Jscrambler npm Package Compromised in Supply Chain Attack socket.dev · Blog · 2026-07-11
• Jscrambler npm Supply Chain Attack: Malicious Versions and What to Do sourcetrail.com · Blog · 2026-07-13
• Jscrambler npm Supply Chain Attack: Rust Infostealer Targets Developers sourcetrail.com · Blog · 2026-07-14
• Active Exploitation Alert: Jscrambler npm Packages Compromised in Coordinated Supply Chain Attack (July 2026) rescana.com · Blog · 2026-07-14
• Jscrambler npm Package Compromised: Why It Matters reflectiz.com · Blog · 2026-07-14
• Hackers backdoor Jscrambler npm package with infostealer malware BleepingComputer · News · 2026-07-13
• Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install The Hacker News · News · 2026-07-13
• Jscrambler npm Breach Exposes Developers to Malware govinfosecurity.com · News · 2026-07-14

Threats related to IronWorm Jscrambler npm compromise

• Compromised jscrambler npm Package v8.14.0 Drops Rust Infostealer via Preinstall Hook
• jscrambler npm Package Supply Chain Compromise (v8.14.0 Malicious Release)
• AsyncAPI npm Supply Chain Attack: Pwn-Request GitHub Actions Compromise Deploys Miasma Tasking Framework
• TeamPCP @antv Supply Chain Wave — Mini Shai-Hulud Multi-Ecosystem npm/GitHub Actions/VSCode Compromise
• npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma Botnet via IPFS-Hosted Second-Stage Payload

Related coverage of this activity

• Miasma 57-package npm worm
• Miasma PyPI wave
• ChainDrop Keyv npm worm
• Atomic Arch forged KDE commits
• SAP CAP Mini Shai-Hulud

Previous and next in supply chain

• Compromised @injectivelabs/sdk-ts npm Package (v1.20.21) Exfiltrates Cryptocurrency Wallet Mnemonics and Private Keys via Fake Telemetry Next report

Further reading

• Axios Supply Chain Attack: Cross-Platform RATs
• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• npm Supply Chain Attacks 2026: 218 Packages