Compromised jscrambler npm Package (v8.14.0) Infostealer Injection
First seen Jul 12, 2026 · Updated Jul 12, 2026
The popular jscrambler npm package was compromised, with a malicious 8.14.0 release published on July 11, 2026 that executes a Rust-based infostealer via a preinstall hook during npm install. The attack drops platform-specific native binaries for Windows, macOS, and Linux, meaning any developer or CI/CD system installing this version is automatically compromised. Socket detected the malicious release within six minutes of publication, but organizations that auto-updated or pulled the package before detection remain at risk.
Technical Analysis
The malicious package leverages npm's preinstall lifecycle hook to silently execute a native infostealer binary immediately upon `npm install`, requiring no further user interaction. Separate binaries were compiled for Windows, macOS, and Linux, indicating a cross-platform harvesting operation targeting credentials, environment variables, SSH keys, cloud tokens, and browser-stored secrets. Because jscrambler is commonly pulled into build pipelines and CI/CD systems, the blast radius extends to any automated environment executing `npm install` without pinned versions or lockfile verification. AI agent frameworks and RAG pipelines that programmatically install npm dependencies (e.g., autonomous coding agents, DevOps automation agents, or CI bots with LLM-driven package management) are particularly exposed, since compromised installs could exfiltrate API keys, cloud credentials, and LLM provider tokens used by those agents, enabling downstream account takeover or further supply-chain propagation.
Affected Systems
npm package jscrambler version 8.14.0; any Node.js/npm-based development, build, or CI/CD environment (Windows, macOS, Linux) that installed this specific version between publication and takedown
Indicators of Compromise
- Package: jscrambler@8.14.0 (npm registry)
- Malicious preinstall script embedded in package.json
- Native infostealer binaries dropped for win32/darwin/linux architectures during install
- Outbound connections from build/CI hosts to unknown exfiltration endpoints (specific C2 domains/IPs not disclosed in source)
Remediation Steps
- 1
Remove and downgrade the package
Immediately uninstall jscrambler 8.14.0 from all projects and CI/CD pipelines; pin to a known-good prior version and verify package integrity via checksums.
- 2
Audit systems that ran the install
Scan any host, container, or CI runner that executed npm install with this version for the dropped native binary and signs of credential exfiltration.
- 3
Rotate exposed credentials
Rotate all API keys, cloud credentials, SSH keys, npm tokens, and LLM/agent provider secrets present on affected machines, especially those used by automated agent or CI systems.
- 4
Enforce lockfiles and install controls
Use package-lock.json/npm-shrinkwrap with integrity hashes, disable lifecycle scripts by default (--ignore-scripts), and adopt automated supply-chain scanning (e.g., Socket) in CI pipelines.
- 5
Monitor for indicators
Check outbound network logs from build infrastructure for unusual connections coinciding with the install timeframe and hunt for the dropped native binaries by hash once published by researchers.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.