The jscrambler npm package was compromised in a supply chain attack that deploys a Rust-based infostealer directly onto developer machines during installation. Version 8.14.0, published on July 11, 2026, contains a preinstall hook that drops and executes a native binary on Windows, macOS, and Linux systems. Security firms flagged the malicious release within six minutes of its publication, but any build system that pulled it during that window has already run the payload with whatever access the install process held.
The Attack Mechanism: How jscrambler 8.14.0 Deploys Malware
None of the malicious code exists in the prior release, 8.13.0. A package diff reveals two new files under dist/: setup.js, a small loader, and intro.js. Despite its name, intro.js is not JavaScript but an approximately 7.8 MB container packing three gzip-compressed native binaries, one each for Linux, Windows, and macOS. On install, setup.js selects the binary for the host operating system, writes it under a random name in the system temp directory, marks it executable, and launches it detached with its output hidden.
These files are present in the published package but nowhere in jscrambler’s public source repository. No matching commit, tag, or pull request exists for version 8.14.0 in the project’s GitHub repository. The latest tag remains 8.13.0, and the malicious version was pushed directly to npm under a legitimate maintainer account, bypassing the normal release flow. This points to a compromised npm account or build pipeline, though which specific vector was used has not yet been confirmed.
What the Infostealer Targets
The payload is a Rust-based infostealer, compiled for all three platforms, that sweeps a developer machine for credentials and exfiltrates them to a command-and-control server over TLS. Its target list is broad and specifically aimed at developers: cloud credentials from AWS, Azure, and Google Cloud, including the metadata endpoints used by CI runners; cryptocurrency wallets and seed phrases from MetaMask, Phantom, and Exodus; the Bitwarden password manager vault; browser-stored passwords and cookies; and session tokens for Discord, Slack, Telegram, and Steam.
The stealer also targets configuration files for AI coding tools, including Claude Desktop, Cursor, Windsurf, VS Code, and Zed, where API keys and Model Context Protocol server credentials commonly reside. This represents a newer and increasingly valuable attack surface as development teams adopt AI-assisted workflows.
Advanced Capabilities: eBPF, Persistence, and Anti-Debugging
The binaries do more than steal credentials. On Linux, the payload links the kernel’s BPF library and can load an eBPF program directly into the kernel from memory, providing a kernel-level foothold beyond the userspace file access the rest of the stealer relies on. Security researchers are still analyzing what the eBPF component does, but the capability represents a significant escalation in what an npm install hook can achieve.
The Windows and macOS builds add anti-debugging checks. The stealer also wires in persistence mechanisms to survive reboots: a hidden Windows scheduled task set to relaunch every minute, and a macOS LaunchAgent that reloads on login. The command-and-control infrastructure details remain encrypted in the binary and have not surfaced in static analysis. Runtime monitoring captured the dropped binary reaching out to two hard-coded IP addresses and to Tor infrastructure, providing the first network indicators for the campaign.
Supply Chain Context and the npm 12 Mitigation
jscrambler is a build-time tool, installed as a development dependency or run from CI environments that hold precisely what this stealer targets: cloud keys, deploy tokens, and source code access. The package sees approximately 15,800 downloads per week, and how many pulled the compromised version remains unknown. For a stealer aimed at build machines, broad reach was never the objective — targeted access was.
This attack follows a pattern of high-profile npm supply chain compromises. The Shai-Hulud worm ran from an install hook to steal tokens and spread through hundreds of packages. The widely used chalk and debug packages were taken over through a phished maintainer account. In March, a hijacked account pushed a cross-platform trojan into Axios, an HTTP library with more than 83 million weekly downloads.
The timing is notable: npm 12 shipped on July 8, three days before this release, with dependency install scripts disabled by default. On npm 12, a preinstall hook like the one in jscrambler 8.14.0 does not run unless explicitly approved. Older clients still execute them automatically. Version 8.15.0 has since been published from the same maintainer account and shows none of the malware indicators — no install script, no bundled binary — but 8.14.0 has not been removed from npm. Any lockfile or command pinned to it continues to install the stealer.
What Affected Users Should Do Now
- Remove the malicious version immediately. Upgrade to 8.15.0 or pin to 8.13.0, and clear [email protected] from all lockfiles and caches.
- Determine whether 8.14.0 was installed. Check lockfiles and package-manager logs for [email protected], and CI records for any execution of dist/setup.js from July 11 onward. The loader drops its payload under a random name in the temp directory, so correlate install timestamps against Node child processes and temp-directory execution. On Windows, inspect Task Scheduler for hidden tasks. On macOS, examine ~/Library/LaunchAgents for unfamiliar plist files.
- Rotate every credential the machine could reach. Treat all secrets as stolen, not merely exposed. Rotate cloud keys, npm and GitHub tokens, AI-tool and MCP API keys. Revoke Discord, Slack, browser, and Bitwarden sessions. Move any cryptocurrency out of wallets on the affected host. Block the two command-and-control IP addresses listed below.
Indicators of Compromise
Malicious package: [email protected]
SHA-256 hashes for the added files and decompressed payloads:
- dist/setup.js: a742de963f14a92d24ebcbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60
- dist/intro.js: a41a523ef9517aab37ed6eea0ec881821bdcb7aefcb5c5f603adc7907f868c86
- Linux payload: fbbcf4d8f98168f78f5c0c47a9ae56d59ec8ac84a7c9ca6b797fedfb8d62d2bd
- Windows payload: b7ca95d1b23c8e67416a25cedf741de0917c2096bbc9d24649eea7853d054903
- macOS payload: c8fd47d36bdf7c825378593ab82ed8c24d1dc52e26b507812393e24e1d5201fd
Network endpoints observed at runtime:
- C2 IP: 37.27.122[.]124
- C2 IP: 57.128.246[.]79
- Tor infrastructure: check.torproject[.]org, archive.torproject[.]org
On-host artifacts: A randomly named hidden file in the system temp directory, of the form .{random} or .{random}.exe on Windows, plus a hidden Windows scheduled task or a macOS LaunchAgent for persistence. Deploying a comprehensive endpoint detection and response solution with behavioral monitoring capabilities is essential for identifying such fileless execution patterns and unauthorized persistence mechanisms on developer workstations.
