- Five malicious versions of the jscrambler npm package (8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0) were published using a compromised npm credential, carrying a Rust-based infostealer.
- The malware executes via a preinstall hook or at runtime, targeting cloud credentials, cryptocurrency wallets, browser data, AI tool configs, and more, with persistence mechanisms on Windows and macOS.
- Security firms like Socket, StepSecurity, SafeDep, and JFrog detected the attack within minutes, but the malicious packages remained on npm for hours; JFrog identified the payload as IronWorm with self-propagation capabilities.
- Developers are urged to upgrade to version 8.22.0, rotate all secrets, and audit systems for signs of compromise, as the stealer can also spread via stolen npm tokens.
On July 11, 2026, the npm package for jscrambler, a commercial JavaScript obfuscation and security tool, was hijacked by an attacker who used a stolen publishing credential to push multiple malicious versions. The incident, which unfolded over roughly three hours, saw five releases—8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0—carry a cross-platform infostealer that activates immediately upon installation or import. Security firms including Socket, StepSecurity, SafeDep, and JFrog flagged the threat within minutes, but the packages remained downloadable for hours, and version 8.14.0 was never removed from the registry.
The attack targeted the software supply chain at its most vulnerable point: the developer’s machine. Unlike many npm incidents that exploit runtime code, this one used a preinstall hook in the first three malicious versions, meaning simply running npm install jscrambler@8.14.0 was enough to drop and execute a native binary. Later versions (8.18.0 and 8.20.0) moved the dropper into the package’s main code, so even --ignore-scripts would not stop the payload. Jscrambler confirmed the breach was limited to its Code Integrity product and has since revoked the compromised credentials, hardened its pipeline, and released a clean version 8.22.0.
The Attack Vector: A Stolen Credential and a Hidden Payload
The malicious releases were published under a legitimate maintainer account, bypassing the project’s normal GitHub-based release flow. No matching commit, tag, or pull request existed for any of the tainted versions in the public repository, according to StepSecurity and SafeDep. The package diff between 8.13.0 and 8.14.0 revealed two new files: dist/setup.js, a small loader, and dist/intro.js, a 7.8 MB container holding three gzip-compressed native binaries for Windows, macOS, and Linux. On install, setup.js selects the appropriate binary, writes it under a random name in the system temp directory, marks it executable, and launches it with its output hidden.
Socket detected the first malicious release just six minutes after it hit the registry. The attacker then pushed four more versions over the next three hours, each carrying the same Rust-compiled infostealer. JFrog later identified the payload as IronWorm, a stealer it had documented a month earlier, and linked it to the Shai-Hulud lineage. The malware’s command-and-control (C2) infrastructure included two hard-coded IP addresses (37.27.122.124 and 57.128.246.79) and Tor network addresses, which StepSecurity’s runtime monitoring observed.
What the Malware Targets
The infostealer’s target list is broad and specifically aimed at developers. It sweeps for cloud credentials from AWS, Azure, and Google Cloud, including metadata endpoints used by CI runners. It also hunts for cryptocurrency wallets and seed phrases from MetaMask, Phantom, Exodus, and others, as well as the Bitwarden password manager vault. Browser-stored passwords, cookies, and session tokens for Discord, Slack, Telegram, and Steam are also collected. Notably, the malware goes after configuration files for AI coding tools like Claude Desktop, Cursor, Windsurf, VS Code, and Zed, where API keys and Model Context Protocol (MCP) server credentials often reside.
JFrog’s analysis expanded the target list further, adding VPN configuration files, 1Password vaults, Tor hidden-service keys, and the install folders of red-team frameworks such as Metasploit, Sliver, and Havoc. This last target suggests the attackers were also aiming at security researchers and penetration testers. The malware uses strong per-string obfuscation via ChaCha20-Poly1305 encryption, making reverse engineering difficult. For bulk exfiltration, it uploads stolen data directly to temp.sh, a public file host, over a connection that leaks the victim’s real IP.
Persistence and Advanced Capabilities
The payload goes beyond simple theft. On Linux, it links the kernel’s BPF library and can load an eBPF program directly into kernel memory, providing a foothold far beyond userspace file access. StepSecurity and SafeDep both flagged this eBPF capability, though its exact function is still being analyzed. On Windows and macOS, the stealer adds anti-debugging checks and persistence mechanisms: a hidden Windows scheduled task set to relaunch every minute, and a macOS LaunchAgent that reloads on login. The C2 details remain encrypted in the binary and never surfaced in static analysis.
JFrog also discovered a self-propagation routine. The malware hunts for npm tokens in environment variables and files like .npmrc, checks them against the registry, picks high-download packages, injects a malicious setup.mjs preinstall script into their tarballs, and publishes the infected versions directly to registry.npmjs.org via raw HTTP PUT—without ever calling the npm client. While JFrog confirmed the routine in the code, it did not confirm that the worm managed to publish anything through a stolen token. However, the implication is clear: any machine that ran an affected version could have its npm tokens used to spread the attack further.
The Response and Cleanup
Jscrambler acted quickly after being notified. The company deprecated the malicious versions and released 8.15.0, then later 8.22.0 as the recommended clean version. However, version 8.14.0 was never pulled from npm, meaning any lockfile or command pinned to it still installs the stealer. The company’s advisory listed four malicious versions (8.14.0, 8.16.0, 8.17.0, 8.20.0) but omitted 8.18.0, which Socket and JFrog both include. Jscrambler says npm currently reports zero downloads of the malicious versions, but cautions that the count lags by hours and is still being verified.
For developers, the immediate steps are clear: upgrade to version 8.22.0 or pin to 8.13.0, and audit all systems that may have pulled the malicious releases. Check lockfiles and package-manager logs for jscrambler@8.14.0 and similar versions, and look for CI records of dist/setup.js execution from July 11 onward. On Windows, inspect Task Scheduler for hidden tasks; on macOS, check ~/Library/LaunchAgents for unfamiliar plists. The loader drops its payload under a random name in the temp directory, so there is no fixed binary name to grep for—line up install timestamps against Node child processes and temp-directory execution instead.
Indicators of Compromise
Security firms have published detailed indicators. The malicious package versions are jscrambler@8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0. SHA-256 hashes for the added files and decompressed payloads are available from Socket and StepSecurity. Network endpoints observed at runtime include the two C2 IPs (37.27.122.124 and 57.128.246.79) and Tor infrastructure (check.torproject.org, archive.torproject.org). On-host artifacts include a randomly named hidden file in the system temp directory (of the form .{random} or .{random}.exe on Windows), plus a hidden Windows scheduled task or macOS LaunchAgent for persistence. JFrog also flags temp.sh as a data exfiltration endpoint and setup.mjs as the propagation script.
If you ran any affected version, treat every secret it could reach as stolen. Rotate cloud keys, npm and GitHub tokens, AI-tool and MCP API keys, revoke Discord, Slack, browser, and Bitwarden sessions, and move any crypto out of wallets on that host. Block the two C2 IPs and monitor for unusual outbound connections to Tor or temp.sh. The stealer does its work in the seconds after install, so even a brief exposure is enough to compromise credentials.
This incident is a stark reminder that the npm ecosystem remains a prime target for supply chain attacks. Despite npm 12 shipping with install scripts off by default on July 8, older clients still run them automatically, and the later malicious versions bypassed that protection entirely. The Jscrambler attack, coming just days after the Injective SDK compromise, shows that attackers are increasingly targeting developer tools and security vendors themselves. The lesson is clear: any machine that runs npm install with real credentials is trusting a supply chain that a single stolen token can turn hostile in minutes.
