- A malicious version of jscrambler (8.14.0) was published on npm using a stolen credential, containing a hidden preinstall hook that drops a cross-platform Rust infostealer.
- The stealer targets cloud credentials, crypto wallets, password managers, AI coding tool configs, and messaging apps, and also includes kernel-level capabilities on Linux.
- The attacker pushed five malicious versions over three hours, with later versions bypassing --ignore-scripts by embedding the dropper in the main code.
- Jscrambler has released a clean version (8.22.0) and advises users to rotate all exposed credentials and audit their systems.
On July 11, 2026, the npm package for Jscrambler, a well-known JavaScript obfuscation and security vendor, was hit by a supply chain attack that went far beyond a simple code injection. The attacker used a stolen npm publishing credential to push version 8.14.0, which carried a preinstall hook that silently dropped and executed a native binary on the victim’s machine. Socket.dev flagged the malicious release just six minutes after it hit the registry, but by then the damage was already done for anyone who installed it during that window.
The compromised package was not an isolated incident. Over the next three hours, the same actor pushed four more malicious versions—8.16.0, 8.17.0, 8.18.0, and 8.20.0—each carrying the same cross-platform Rust infostealer. The attack exploited a fundamental trust in the npm ecosystem, where a single compromised account can turn a legitimate development tool into a weapon aimed at the very developers who rely on it.
The Attack: A Stolen Credential and a Hidden Payload
Version 8.14.0 introduced two new files that were not present in the previous clean release, 8.13.0: dist/setup.js and dist/intro.js. Despite its name, intro.js was not JavaScript but a roughly 7.8 MB container holding three gzip-compressed native binaries—one each for Linux x86-64, Windows x86-64, and macOS arm64. During installation, setup.js identified the host operating system, wrote the corresponding binary to a randomly named file in the system temp directory, marked it executable, and launched it with its output hidden. The payload then ran with the same privileges as the install process, which on a developer machine or CI runner often includes access to sensitive credentials and tokens.
Jscrambler later confirmed that the attacker had compromised an npm publishing credential and used it to bypass the project’s normal release flow. No matching commit, tag, or pull request existed in the public GitHub repository for version 8.14.0. The version was pushed directly to npm, pointing to a hijacked account or build pipeline. The company revoked the credential, rotated secrets, and hardened its publishing pipeline, but the malicious versions remained on npm—deprecated but still installable by exact version.
What the Stealer Targets
The Rust-built infostealer was designed with a broad and developer-focused target list. According to analyses from Socket, StepSecurity, and JFrog, it sweeps for cloud credentials from AWS, Azure, and Google Cloud, including metadata endpoints used by CI runners. It also hunts cryptocurrency wallets and seed phrases from MetaMask, Phantom, Exodus, TrustWallet, and Coinbase Wallet, as well as the Bitwarden password manager vault. Browser-stored passwords and cookies, along with sessions from Discord, Slack, Telegram, and Steam, are also fair game.
What sets this stealer apart is its focus on AI coding tools. It targets configuration files for Claude Desktop, Cursor, Windsurf, VS Code, and Zed, where API keys and Model Context Protocol (MCP) server credentials are often stored. JFrog’s analysis also revealed that the malware reaches for VPN configuration files, Tor hidden-service keys, and even the install folders of red-team frameworks like Metasploit, Sliver, and Havoc—suggesting the attackers were specifically aiming at security researchers and penetration testers.
Campaign Evolution and Evasion Tactics
The attacker did not stop at the initial preinstall hook. Starting with version 8.18.0, the delivery method shifted: the dropper was moved into the package’s main code and CLI entry points, so it fired when the package was imported or run, rather than during installation. This change bypassed the npm install –ignore-scripts safeguard that many developers rely on, and also evaded scanners that only inspect install scripts. The later versions also included anti-debugging checks on Windows and macOS, and the stealer wired in persistence mechanisms—a hidden Windows scheduled task set to relaunch every minute, and a macOS LaunchAgent that reloads on login.
On Linux, the payload went a step further by linking the kernel’s BPF library and loading an eBPF program directly into the kernel from memory. This gave the attacker a foothold at the kernel level, beyond the usual userspace file access. StepSecurity and SafeDep both flagged this capability, though the exact purpose of the eBPF program is still under analysis. The command-and-control details remained encrypted in the binary, but StepSecurity’s runtime monitoring observed the dropped binary reaching out to two hard-coded IP addresses and Tor infrastructure.
Indicators of Compromise and Mitigation Steps
The malicious versions identified are 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0. Version 8.15.0, published between the first two, appears clean, and Jscrambler has designated version 8.22.0 as the safe release to upgrade to. The SHA-256 hashes for the added files and their decompressed payloads have been published by security firms, along with the two C2 IP addresses: 37.27.122.124 and 57.128.246.79. On-host artifacts include a randomly named hidden file in the system temp directory, plus a hidden Windows scheduled task or macOS LaunchAgent for persistence.
If you or your build systems installed any affected version, the first step is to upgrade to 8.22.0 immediately and remove all traces of the malicious versions from lockfiles and caches. Next, audit the workstation or CI runner that pulled the package. Check installation logs for execution of dist/setup.js, and look for unexpected child processes or temp-directory execution around the time of installation. On Windows, inspect Task Scheduler for hidden tasks; on macOS, check ~/Library/LaunchAgents for unfamiliar plists. Finally, treat every secret that the machine could reach as stolen—rotate cloud keys, npm and GitHub tokens, AI-tool and MCP API keys, revoke Discord, Slack, browser, and Bitwarden sessions, and move any cryptocurrency out of wallets on that host.
The attack underscores a harsh reality: in the npm ecosystem, a single compromised credential can turn a trusted development tool into a vector for credential theft and lateral movement. The speed of detection—six minutes for the first release—was impressive, but the attacker’s ability to push multiple versions and adapt the delivery method shows that supply chain defenses must evolve beyond simple script inspection. For now, the cleanest path forward is to pin to a verified release and treat any exposure as a full compromise of the affected environment.
