Jscrambler npm Package Compromised: IronWorm Cross-Platform Infostealer (Shai-Hulud Lineage) via Rust Native Binaries
Jscrambler npm Package Compromised (TL-2026-1379), also tracked as Jscrambler Supply Chain Attack, is a high-severity supply-chain compromise, first published 2026-07-15. It has no confirmed attribution, affects Jscrambler jscrambler (npm package), maps to 31 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-1379
- Threat ID
- TL-2026-1379
- Also known as
- Jscrambler Supply Chain Attack, IronWorm npm Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-15
- Last reviewed
- 2026-07-15
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, cross-sector any npm-consuming organization
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in Jscrambler npm Package Compromised
Malware and tooling: IronWorm, Shai-Hulud, npm publishing credential (stolen)
Attackers used a stolen npm publishing credential to push five malicious versions of the Jscrambler npm package (8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0) between July 11-15, 2026, deploying a Rust-based cross-platform infostealer identified by JFrog as IronWorm, part of the Shai-Hulud worm lineage. The malware harvests browser, cloud (AWS/Azure/GCP), cryptocurrency, password-manager, communications, AI-dev-tool, and Steam credentials, establishes OS-specific persistence, and exfiltrates data to temp.sh and observed Tor infrastructure, while also hunting for additional npm tokens to self-propagate into other high-download packages.
How Jscrambler npm Package Compromised works
On July 11, 2026, an attacker leveraging a compromised npm publishing credential belonging to Jscrambler (a commercial JavaScript obfuscation and application-security vendor) published version 8.14.0 of the `jscrambler` npm package containing an undocumented `preinstall` script pointing to `dist/setup.js`. This loader reads a 7.8 MB container file (`dist/intro.js`, magic header `1B 43 53 49 01`) holding three gzip-compressed, platform-specific native executables (Linux ELF, Windows PE32+, macOS Mach-O arm64). The loader decompresses the binary matching the host OS, writes it to a randomly named file in the temp directory, and spawns it detached with `stdio: 'ignore'` and `windowsHide: true`, requiring no further user interaction beyond `npm install`.
Socket's automated scanning flagged the package roughly six minutes after publication, but the attacker continued publishing malicious releases across a roughly three-hour window: 8.16.0 and 8.17.0 retained the preinstall-hook delivery, while 8.18.0 and 8.20.0 moved the dropper logic into a self-executing function injected at the top of `dist/index.js` and `dist/bin/jscrambler.js`, triggering on `require()`/import or CLI invocation. This evolution specifically defeated `npm install --ignore-scripts` and npm 12's July 8, 2026 default of disabling install scripts, since execution no longer depended on any lifecycle script.
JFrog's subsequent malware analysis identified the compiled payload as **IronWorm**, a Rust-based infostealer first documented roughly one month prior and linked to the **Shai-Hulud** worm lineage of npm supply-chain malware. IronWorm is a full-featured credential harvester: it targets browser-stored passwords/cookies/sessions (Chrome, Firefox, Edge) via embedded SQLite/LevelDB parsers; cryptocurrency wallets and seed phrases (MetaMask, Trust Wallet, Coinbase Wallet, Phantom, Exodus) using scrypt-based vault decryption attempts and an embedded BIP39 English wordlist for seed-phrase identification; password manager vaults (Bitwarden); cloud provider credentials via AWS ECS task metadata endpoints, Azure IMDS, and GCP metadata tokens, plus associated Secrets Manager/Parameter Store access; communications app sessions (Discord, Slack, Telegram) and Steam session data; AI developer tool configuration files (Claude Desktop, Cursor, Windsurf, VS Code, Zed) that store API keys and Model Context Protocol (MCP) server credentials; and VPN configuration files.
The malware establishes OS-specific persistence: a hidden Windows Scheduled Task that relaunches the payload every minute; a macOS LaunchAgent that reloads on user login; and on Linux, dynamic loading of eBPF programs via `libbpf.so.1` for kernel-level instrumentation and sustained access. Anti-analysis features include `IsDebuggerPresent` and `GetExtendedTcpTable`-based process enumeration on Windows and `sysctl`-based debugger detection on macOS.
Harvested data is compressed and encrypted, then exfiltrated primarily via direct HTTPS upload to `temp.sh`, a public anonymous file-hosting service, avoiding the need for attacker-controlled C2 infrastructure for the bulk-data channel. Independent network monitoring (StepSecurity Harden-Runner) additionally observed outbound connections from infected hosts to Tor Project infrastructure (`check.torproject.org`, `archive.torproject.org`, and associated IPs `37.27.122.124` and `57.128.246.79`), consistent with either connectivity/reachability checks for a Tor-routed secondary exfiltration path or anti-analysis network fingerprinting; independent confirmation of a full Tor exfiltration channel remains unverified per source reporting.
Consistent with the Shai-Hulud worm lineage, IronWorm also actively hunts infected developer machines for additional valid npm publishing tokens, which it uses to self-propagate by injecting malicious `setup.mjs`-style dropper scripts into other high-download npm packages the compromised developer has publish rights to — giving the campaign worm-like supply-chain spread potential beyond the initial Jscrambler compromise.
Jscrambler's weekly download count of roughly 15,800 limited but did not eliminate blast radius; npm's platform-level telemetry initially reported near-zero installs of the malicious versions pending verification. Jscrambler revoked and rotated its publishing credentials and related secrets and deprecated the affected releases; clean releases resume at 8.22.0 (last known-clean pre-compromise version was 8.13.0, published June 30, 2026).
MITRE ATT&CK techniques used in TL-2026-1379
Collection
T1005 Data from Local System; T1074 Data Staged; T1560 Archive Collected Data
Defense Evasion
T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1202 Indirect Command Execution; T1497.001 System Checks
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Discovery
T1049 System Network Connections Discovery; T1057 Process Discovery; T1083 File and Directory Discovery; T1526 Cloud Service Discovery
Persistence
T1053.005 Scheduled Task; T1543.001 Launch Agent; T1547.006 Kernel Modules and Extensions
Privilege Escalation
Execution
T1059.007 JavaScript; T1106 Native API; T1204 User Execution
Command and Control
T1071.001 Web Protocols; T1090.003 Multi-hop Proxy; T1102 Web Service
initial-access
T1195.002 Compromise Software Supply Chain
Initial Access
T1195.002 Compromise Software Supply Chain
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1552.005 Cloud Instance Metadata API; T1555.003 Credentials from Web Browsers; T1555.005 Password Managers
Resource Development
Impact
Affected products and versions in Jscrambler npm Package Compromised
- Jscrambler — jscrambler (npm package)
Vulnerable versions: 8.14.0; 8.16.0; 8.17.0; 8.18.0; 8.20.0
Fixed in: 8.22.0
Remediation for Jscrambler npm Package Compromised
Patches
- Upgrade jscrambler to 8.22.0 or later
Immediate actions
- Remove jscrambler versions 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0 from package.json, lockfiles, and local npm caches on all developer and CI/CD machines
- Upgrade to jscrambler@8.22.0 (confirmed clean) or pin to the last known-clean 8.13.0
- Treat any machine that installed an affected version as fully compromised
- Blacklist C2 IPs 37.27.122.124 and 57.128.246.79 at the network perimeter and monitor for outbound connections to check.torproject.org / archive.torproject.org
- Block or alert on outbound uploads to temp.sh from developer and build endpoints
Workarounds
- Pin jscrambler to 8.13.0 until 8.22.0 is verified in your environment
- Run npm install with --ignore-scripts as defense-in-depth (note: does NOT stop the require()-time dropper in 8.18.0/8.20.0, so must be paired with version pinning)
Longer-term hardening
- Enforce npm install-script allowlisting / disable lifecycle scripts by default (npm 12 default) across all engineering and CI/CD environments
- Adopt supply-chain scanning (Socket, StepSecurity Harden-Runner, JFrog Xray or equivalent) on all package installs
- Require signed/attested npm publishes and hardware-token-backed publishing credentials for maintainers of widely-depended packages
- Deploy EDR with eBPF-aware behavioral detection on Linux build/dev hosts to catch kernel-level instrumentation techniques
Weaknesses (CWE) in Jscrambler npm Package Compromised
CWE-506, CWE-494, CWE-829, CWE-522
Timeline of Jscrambler npm Package Compromised
- jscrambler 8.13.0 published — the last verified clean version before the compromise.
- npm 12 ships with install scripts disabled by default, a defense the attacker's later require()-time payload was specifically engineered to bypass.
- StepSecurity Harden-Runner observes outbound connections from compromised hosts to Tor Project infrastructure (check.torproject.org, archive.torproject.org, IPs 37.27.122.124 and 57.128.246.79); endpoints are added to StepSecurity's global block list.
- Over a roughly three-hour window (through 17:53 UTC) the attacker publishes four additional malicious versions — 8.16.0, 8.17.0, 8.18.0, 8.20.0 — with 8.18.0 and 8.20.0 moving the dropper from the preinstall hook into a self-executing function in dist/index.js and dist/bin/jscrambler.js to survive --ignore-scripts.
- Socket's automated scanning flags jscrambler 8.14.0 as malicious approximately six minutes after publication.
- Attacker publishes malicious jscrambler 8.14.0 at 15:12 UTC using a stolen npm publishing credential; the release contains a preinstall hook (dist/setup.js) that drops and executes a platform-specific native infostealer binary.
- Bleeping Computer and The Hacker News publish public coverage of the compromise, widening awareness beyond the initial security-vendor detections.
- Jscrambler revokes and rotates its compromised npm publishing credentials and related secrets, deprecates the five malicious releases, and adds additional publishing-pipeline controls.
- JFrog malware analysis identifies the payload as IronWorm, a Rust-based infostealer documented roughly one month earlier and linked to the Shai-Hulud npm worm lineage, including self-propagation via stolen npm tokens.
- jscrambler 8.22.0 is published and confirmed clean; developers are urged to upgrade or pin back to 8.13.0 and rotate all credentials exposed on affected machines.
Sources cited for Jscrambler npm Package Compromised
- Jscrambler npm Package Compromised in Supply Chain Attack
- Jscrambler npm package publishes malicious preinstall binary
- Jscrambler npm Package Compromised in Supply Chain Attack
- Hackers backdoor Jscrambler npm package with infostealer malware
- Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install
- Jscrambler npm Supply Chain Attack: Malicious Versions and What to Do
- Jscrambler npm Supply Chain Attack: Rust Infostealer Targets Developers
- Active Exploitation Alert: Jscrambler npm Packages Compromised in Coordinated Supply Chain Attack (July 2026)
- Jscrambler npm Breach Exposes Developers to Malware
- Jscrambler npm Package Compromised: Why It Matters
Threats related to Jscrambler npm Package Compromised
- Compromised jscrambler npm Package v8.14.0 Drops Rust Infostealer via Preinstall Hook
- jscrambler npm Package Supply Chain Compromise (v8.14.0 Malicious Release)
- AsyncAPI npm Supply Chain Attack: Pwn-Request GitHub Actions Compromise Deploys Miasma Tasking Framework
- TeamPCP @antv Supply Chain Wave — Mini Shai-Hulud Multi-Ecosystem npm/GitHub Actions/VSCode Compromise
- npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma Botnet via IPFS-Hosted Second-Stage Payload
- Binding.gyp "Phantom Gyp" Supply Chain Attack (Miasma Worm) Enables CI/CD Worm Propagation Across 57 npm Packages
Detection coverage for TL-2026-1379
As of 2026-07-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1379 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1379
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.