Jscrambler npm 8.14.0 Compromised: Rust Infostealer Drops on Install
On July 11, 2026, the popular jscrambler npm package was compromised in a textbook software supply chain attack, with attackers publishing version 8.14.0 carrying a preinstall hook that executes a Rust-based infostealer on the developer's machine. The malicious version was pushed directly to npm under a legitimate maintainer account, bypassing the project's normal release flow. Socket flagged the tainted release just six minutes after publication, and both StepSecurity and SafeDep independently confirmed that no matching commit, tag, or pull request exists in jscrambler's public GitHub repository, where the latest tag remains 8.13.0. The published package contained two new files under dist/ that appear nowhere in the open source: setup.js, a small loader, and intro.js, a roughly 7.8MB container packing three gzip-compressed native binaries targeting Linux, Windows, and macOS.
On install, setup.js selects the binary for the host OS, writes it under a random name in the system temp directory, marks it executable, and launches it detached with its output hidden. The payload is a cross-platform infostealer that sweeps developer machines for cloud credentials from AWS, Azure, and Google Cloud (including CI runner metadata endpoints), cryptocurrency wallets and seed phrases from MetaMask, Phantom, and Exodus, the Bitwarden password manager vault, browser-stored passwords and cookies, and active sessions for Discord, Slack, Telegram, and Steam. It also targets the config files of AI coding tools, including Claude Desktop, Cursor, Windsurf, VS Code, and Zed, where API keys and Model Context Protocol server credentials are commonly stored. Stolen data is exfiltrated to a drop server over TLS, with C2 details encrypted inside the binary to frustrate static analysis. Given the breadth of credential theft involved, developers should immediately run a password strength and breach check on any secrets that may have lived on a machine where this package was installed, and rotate every exposed key.
The Linux variant is the most technically aggressive, linking the kernel's BPF library and capable of loading an eBPF program directly into the kernel from memory, an unusual capability for a stealer that grants userspace-to-kernel foothold well beyond the file access the rest of the payload relies on. Both StepSecurity and SafeDep flagged the eBPF component, though its precise function is still being reverse-engineered. The Windows and macOS builds add anti-debugging checks and persistence mechanisms to survive reboots: a hidden Windows scheduled task that relaunches the binary every minute, and a macOS LaunchAgent that re-executes the payload on login. The combination of kernel-level hooks on Linux, cross-platform persistence, and a focus on developer-targeted secrets including AI tool credentials makes this a notable escalation in npm supply chain tradecraft.
If you or a CI runner pulled jscrambler 8.14.0, treat the host as fully compromised: the payload ran with whatever privileges the install process held, and secrets cached on disk should be considered exposed. Audit your npm lockfiles for 8.14.0, pin to 8.13.0, and review outbound traffic for unknown TLS connections to unfamiliar endpoints; a quick DNS leak test and port scan on affected hosts can help surface suspicious C2 channels. Run a broader privacy and exposure checkup to inventory the attack surface, rotate every cloud, code-hosting, and AI-tool API key, revoke and reissue cryptocurrency wallet seeds that were ever present on the machine, and rebuild affected systems from clean media rather than relying on malware removal.