Jscrambler npm Package Compromised: IronWorm Cross-Platform Infostealer (Shai-Hulud Lineage) via Rust Native Binaries — Threadlinqs Intelligence
As of 2026-07-15, Jscrambler npm Package Compromised: IronWorm Cross-Platform Infostealer (Shai-Hulud Lineage) via Rust Native Binaries is a high-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-1379 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attackers used a stolen npm publishing credential to push five malicious versions of the Jscrambler npm package (8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0) between July 11-15, 2026, deploying a
On July 11, 2026, an attacker leveraging a compromised npm publishing credential belonging to Jscrambler (a commercial JavaScript obfuscation and application-security vendor) published version 8.14.0 of the `jscrambler` npm package containing an undocumented `preinstall` script pointing to `dist/setup.js`. This loader reads a 7.8 MB container file (`dist/intro.js`, magic header `1B 43 53 49 01`) holding three gzip-compressed, platform-specific native executables (Linux ELF, Windows PE32+, macOS Mach-O arm64). The loader decompresses the binary matching the host OS, writes it to a randomly named file in the temp directory, and spawns it detached with `stdio: 'ignore'` and `windowsHide: true`, requiring no further user interaction beyond `npm install`.
Socket's automated scanning flagged the package roughly six minutes after publication, but the attacker continued publishing malicious releases across a roughly three-hour window: 8.16.0 and 8.17.0 retained the preinstall-hook delivery, while 8.18.0 and 8.20.0 moved the dropper logic into a self-executing function injected at the top of `dist/index.js` and `dist/bin/jscrambler.js`, triggering on `require()`/import or CLI invocation. This evolution specifically defeated `npm install --ignore-scripts` and npm 12's July 8, 2026 default of disabling install scripts, since execution no longer depended on any lifecycle script.
JFrog's subsequent malware analysis identified the compiled payload as **IronWorm**, a Rust-based infostealer first documented roughly one month prior and linked to the **Shai-Hulud** worm lineage of npm supply-chain malware. IronWorm is a full-featured credential harvester: it targets browser-stored passwords/cookies/sessions (Chrome, Firefox, Edge) via embedded SQLite/LevelDB parsers; cryptocurrency wallets and seed phrases (MetaMask, Trust Wallet, Coinbase Wallet, Phantom, Exodus) using scrypt-based vault decryption attempts and an embedded BIP39 English wordlist for seed-phrase identification; password manager vaults (Bitwarden); cloud provider credentials via AWS ECS task metadata endpoints, Azure IMDS, and GCP metadata tokens, plus associated Secrets Manager/Parameter Store access; communications app sessions (Discord, Slack, Telegram) and Steam session data; AI developer tool configuration files (Claude Desktop, Cursor, Windsurf, VS Code, Zed) that store API keys and Model Context Protocol (MCP) server credentials; and VPN configuration files.
The malware establishes OS-specific persistence: a hidden Windows Scheduled Task that relaunches the payload every minute; a macOS LaunchAgent that reloads on user login; and on Linux, dynamic loading of eBPF programs via `libbpf.so.1` for kernel-level instrumentation and sustained access. Anti-analysis features include `IsDebuggerPresent` and `GetExtendedTcpTable`-based process enumeration on Windows and `sysctl`-based debugger detection on macOS.
Harvested data is compressed and encrypted, then exfiltrated primarily via direct HTTPS upload to `temp.sh`, a public anonymous file-hosting service, avoiding the need for attacker-controlled C2 infrastructure for the bulk-data channel. Independent network monitoring (StepSecurity Harden-Runner) additionally observed outbound connections from infected hosts to Tor Project infrastructure (`check.torproject.org`, `archive.torproject.org`, and associated IPs `37.27.122.124` and `57.128.246.79`), consistent with either connectivity/reachability checks for a Tor-routed secondary exfiltration path or anti-analysis network fingerprinting; independent confirmation of a full Tor exfiltration channel remains unverified per source reporting.
Consistent with the Shai-Hulud worm lineage, IronWorm also actively hunts infected developer machines for additional valid npm publishing tokens, which it uses to self-propagate by injecting malicious `setup.mjs`-style dropper scripts into other high-download npm packages the compromised developer has publish rights to — giving the campaign w
Weaknesses (CWE)
CWE-506, CWE-494, CWE-829, CWE-522
Target sectors: technology, software development, cross-sector any npm-consuming organization
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1586, T1195.002, T1195.002, T1059.007, T1106, T1204, T1053.005, T1543.001, T1547.006, T1053.005