# Jscrambler npm Package Compromised: IronWorm Cross-Platform Infostealer (Shai-Hulud Lineage) via Rust Native Binaries

> Attackers used a stolen npm publishing credential to push five malicious versions of the Jscrambler npm package (8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0) between July 11-15, 2026, deploying a Rust-based cross-platform infostealer identified by JFrog as IronWorm, part of the Shai-Hulud worm lineage. The malware harvests browser, cloud (AWS/Azure/GCP), cryptocurrency, password-manager, communications, AI-dev-tool, and Steam credentials, establishes OS-specific persistence, and exfiltrates data to temp.sh and observed Tor infrastructure, while also hunting for additional npm tokens to self-propagate into other high-download packages.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-11-01T15:06:47.329Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1379
- **ID:** TL-2026-1379
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 31 (3 shown free below)

## Description

On July 11, 2026, an attacker leveraging a compromised npm publishing credential belonging to Jscrambler (a commercial JavaScript obfuscation and application-security vendor) published version 8.14.0 of the `jscrambler` npm package containing an undocumented `preinstall` script pointing to `dist/setup.js`. This loader reads a 7.8 MB container file (`dist/intro.js`, magic header `1B 43 53 49 01`) holding three gzip-compressed, platform-specific native executables (Linux ELF, Windows PE32+, macOS Mach-O arm64). The loader decompresses the binary matching the host OS, writes it to a randomly named file in the temp directory, and spawns it detached with `stdio: 'ignore'` and `windowsHide: true`, requiring no further user interaction beyond `npm install`.

Socket's automated scanning flagged the package roughly six minutes after publication, but the attacker continued publishing malicious releases across a roughly three-hour window: 8.16.0 and 8.17.0 retained the preinstall-hook delivery, while 8.18.0 and 8.20.0 moved the dropper logic into a self-executing function injected at the top of `dist/index.js` and `dist/bin/jscrambler.js`, triggering on `require()`/import or CLI invocation. This evolution specifically defeated `npm install --ignore-scripts` and npm 12's July 8, 2026 default of disabling install scripts, since execution no longer depended on any lifecycle script.

JFrog's subsequent malware analysis identified the compiled payload as **IronWorm**, a Rust-based infostealer first documented roughly one month prior and linked to the **Shai-Hulud** worm lineage of npm supply-chain malware. IronWorm is a full-featured credential harvester: it targets browser-stored passwords/cookies/sessions (Chrome, Firefox, Edge) via embedded SQLite/LevelDB parsers; cryptocurrency wallets and seed phrases (MetaMask, Trust Wallet, Coinbase Wallet, Phantom, Exodus) using scrypt-based vault decryption attempts and an embedded BIP39 English wordlist for seed-phrase identification; password manager vaults (Bitwarden); cloud provider credentials via AWS ECS task metadata endpoints, Azure IMDS, and GCP metadata tokens, plus associated Secrets Manager/Parameter Store access; communications app sessions (Discord, Slack, Telegram) and Steam session data; AI developer tool configuration files (Claude Desktop, Cursor, Windsurf, VS Code, Zed) that store API keys and Model Context Protocol (MCP) server credentials; and VPN configuration files.

The malware establishes OS-specific persistence: a hidden Windows Scheduled Task that relaunches the payload every minute; a macOS LaunchAgent that reloads on user login; and on Linux, dynamic loading of eBPF programs via `libbpf.so.1` for kernel-level instrumentation and sustained access. Anti-analysis features include `IsDebuggerPresent` and `GetExtendedTcpTable`-based process enumeration on Windows and `sysctl`-based debugger detection on macOS.

Harvested data is compressed and encrypted, then exfiltrated primarily via direct HTTPS upload to `temp.sh`, a public anonymous file-hosting service, avoiding the need for attacker-controlled C2 infrastructure for the bulk-data channel. Independent network monitoring (StepSecurity Harden-Runner) additionally observed outbound connections from infected hosts to Tor Project infrastructure (`check.torproject.org`, `archive.torproject.org`, and associated IPs `37.27.122.124` and `57.128.246.79`), consistent with either connectivity/reachability checks for a Tor-routed secondary exfiltration path or anti-analysis network fingerprinting; independent confirmation of a full Tor exfiltration channel remains unverified per source reporting.

Consistent with the Shai-Hulud worm lineage, IronWorm also actively hunts infected developer machines for additional valid npm publishing tokens, which it uses to self-propagate by injecting malicious `setup.mjs`-style dropper scripts into other high-download npm packages the compromised developer has publish rights to — giving the campaign worm-like supply-chain spread potential beyond the initial Jscrambler compromise.

Jscrambler's weekly download count of roughly 15,800 limited but did not eliminate blast radius; npm's platform-level telemetry initially reported near-zero installs of the malicious versions pending verification. Jscrambler revoked and rotated its publishing credentials and related secrets and deprecated the affected releases; clean releases resume at 8.22.0 (last known-clean pre-compromise version was 8.13.0, published June 30, 2026).

## MITRE ATT&CK

- T1586 Compromise Accounts
- T1195.002 Compromise Software Supply Chain
- T1195.002 Compromise Software Supply Chain
- T1059.007 JavaScript
- T1106 Native API
- T1204 User Execution
- T1053.005 Scheduled Task
- T1543.001 Launch Agent
- T1547.006 Kernel Modules and Extensions
- T1053.005 Scheduled Task
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 System Checks
- T1036 Masquerading
- T1202 Indirect Command Execution
- T1057 Process Discovery
- T1049 System Network Connections Discovery
- T1083 File and Directory Discovery
- T1526 Cloud Service Discovery
- T1555.003 Credentials from Web Browsers
- T1555.005 Password Managers
- T1552.001 Credentials In Files
- T1552.005 Cloud Instance Metadata API
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1074 Data Staged
- T1071.001 Web Protocols
- T1090.003 Multi-hop Proxy
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft
- T1078 Valid Accounts
- T1564.001 Hide Artifacts
- T1622 Debugger Evasion
- T1027 Obfuscated Files or Information
- T1082 System Information Discovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Data exfiltration to temp.sh or Tor-adjacent infrastructure from developer/CI host** (`TL-2026-1379-SPL-003`)

Detects outbound HTTPS traffic to temp.sh (IronWorm's primary exfiltration channel for compressed/encrypted stolen data) or DNS/connection attempts to check.torproject.org, archive.torproject.org, or the associated IPs 37.27.122.124 / 57.128.246.79 from a developer workstation or CI/CD build host.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1567, T1071.001, T1090.003, T1102, T1041
- **Data sources:** network_stream_dns, network_stream_http, firewall_logs, microsoft_defender_devicenetworkevents
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network (sourcetype="stream:dns" OR sourcetype="stream:http" OR sourcetype="pan:traffic")
| where match(query, "(?i)(temp\.sh|check\.torproject\.org|archive\.torproject\.org)") OR dest_ip IN ("37.27.122.124", "57.128.246.79") OR match(dest, "(?i)temp\.sh")
| eval risk_reason="Outbound connection to IronWorm exfil/Tor-adjacent infrastructure"
| table _time, host, src_ip, dest_ip, dest, query, risk_reason
| sort -_time
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has "temp.sh" or RemoteUrl has_any ("check.torproject.org", "archive.torproject.org") or RemoteIP in ("37.27.122.124", "57.128.246.79")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc
```

### Sigma

```yaml
title: Outbound Connection to temp.sh or Tor-Adjacent Infrastructure from Developer Host
id: 4c6e0a1f-8b25-4a7c-9e0f-5d2a4c8b7f11
status: experimental
description: Detects outbound connections from a developer or CI/CD host to temp.sh (IronWorm's primary bulk-data exfiltration channel), or to Tor Project reachability-check infrastructure (check.torproject.org, archive.torproject.org, 37.27.122.124, 57.128.246.79) observed alongside the Jscrambler/IronWorm supply-chain campaign.
references:
    - https://www.stepsecurity.io/blog/jscrambler-npm-package-publishes-malicious-preinstall-binary
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-15
tags:
    - attack.exfiltration
    - attack.command_and_control
    - attack.t1567
    - attack.t1071.001
    - attack.t1090.003
    - attack.t1102
    - attack.tool.ironworm
    - attack.tool.shai_hulud
logsource:
    category: network_connection
detection:
    selection:
        DestinationHostname|contains:
            - 'temp.sh'
            - 'check.torproject.org'
            - 'archive.torproject.org'
        DestinationIp:
            - '37.27.122.124'
            - '57.128.246.79'
    condition: selection
falsepositives:
    - Security researchers or privacy-conscious developers intentionally using temp.sh or the Tor Browser on a sanctioned workstation
level: critical
```

**Known false positives:**

- Sanctioned security research or privacy tooling on an authorized workstation that legitimately uses temp.sh or Tor

**Tuning notes:** Maintain an allowlist for any sanctioned security-research hosts that use Tor or temp.sh legitimately; correlate with TL-2026-1379-SPL-001/002 process-tree evidence to raise confidence before triggering incident response.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- jscrambler malicious version install followed by native binary write in temp (locked: unlock with TL Creds)
- Bulk credential-store file access by Node.js-spawned or unrelated child process (locked: unlock with TL Creds)
- npm token-hunting and self-propagation into other high-download packages (locked: unlock with TL Creds)
- IronWorm Cross-Platform Payload Anti-Debug / Sandbox Evasion Check (locked: unlock with TL Creds)
- Cloud Instance Metadata Endpoint Queried by Node.js Process (locked: unlock with TL Creds)
- Linux eBPF Kernel Module Loaded via libbpf.so.1 by Node.js-Spawned Process (locked: unlock with TL Creds)
- npm postinstall/require-time IronWorm dropper spawning detached hidden process (locked: unlock with TL Creds)
- IronWorm OS-specific persistence — hidden Scheduled Task, LaunchAgent, or eBPF load (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 31)

Defanged, TLP:CLEAR.

- IP address: `37.27.122[.]124`
- Domain: `check[.]torproject[.]org`
- File hash: `a742de963f14a92d24ebcbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60`

Full set of 31 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Jscrambler npm Package Compromised in Supply Chain Attack](https://threats.wiz.io/all-incidents/jscrambler-npm-package-compromised-in-supply-chain-attack)
- [Jscrambler npm package publishes malicious preinstall binary](https://www.stepsecurity.io/blog/jscrambler-npm-package-publishes-malicious-preinstall-binary)
- [Jscrambler npm Package Compromised in Supply Chain Attack](https://socket.dev/blog/jscrambler-supply-chain-attack)
- [Hackers backdoor Jscrambler npm package with infostealer malware](https://www.bleepingcomputer.com/news/security/hackers-backdoor-jscrambler-npm-package-with-infostealer-malware/)
- [Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install](https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html)
- [Jscrambler npm Supply Chain Attack: Malicious Versions and What to Do](https://www.sourcetrail.com/javascript/jscrambler-npm-package-compromised-malicious-versions-spread-infostealer-across-developer-machines/)
- [Jscrambler npm Supply Chain Attack: Rust Infostealer Targets Developers](https://www.sourcetrail.com/rust/jscrambler-npm-package-compromised-rust-infostealer-targets-developer-credentials-and-ai-tools/)
- [Active Exploitation Alert: Jscrambler npm Packages Compromised in Coordinated Supply Chain Attack (July 2026)](https://www.rescana.com/post/active-exploitation-alert-jscrambler-npm-packages-compromised-in-coordinated-supply-chain-attack-july-2026)
- [Jscrambler npm Breach Exposes Developers to Malware](https://www.govinfosecurity.com/jscrambler-npm-breach-exposes-developers-to-malware-a-32215)
- [Jscrambler npm Package Compromised: Why It Matters](https://www.reflectiz.com/blog/jscrambler-npm-package-compromise/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1379