Version 8.14.0 of the jscrambler npm package, published on July 11, 2026, contains a malicious preinstall hook that drops and executes a Rust-based infostealer on Windows, macOS, and Linux during installation. Security firm Socket flagged the release within six minutes, but any system that installed the package in that window has already been compromised.
The malicious code is triggered simply by installing the package—no import or CLI call is needed. The hook runs before the package is fully set up, and the payload is not present in the previous version 8.13.0. The package diff reveals two new files under dist/: setup.js, a small loader, and intro.js, a 7.8 MB container holding gzip-compressed native binaries for each operating system.
How the Attack Works
On installation, setup.js selects the appropriate binary for the host OS, writes it to the system temp directory under a random name, marks it executable, and runs it detached with output hidden. The added files are in the published package but not in jscrambler's public GitHub repository, which still shows tag 8.13.0. The version was pushed directly to npm under a legitimate maintainer account, indicating a compromised account or build pipeline.
The payload is a Rust infostealer that targets developer machines. It steals cloud credentials from AWS, Azure, and Google Cloud, including metadata endpoints used by CI runners. It also harvests cryptocurrency wallets and seed phrases from MetaMask, Phantom, and Exodus, as well as Bitwarden password manager vaults. Browser-stored passwords, cookies, and session tokens for Discord, Slack, Telegram, and Steam are scraped. Additionally, it targets configuration files for AI coding tools like Claude Desktop, Cursor, Windsurf, VS Code, and Zed, where API keys and Model Context Protocol server credentials are often stored.
Advanced Capabilities and Persistence
The malware goes beyond ordinary theft. On Linux, it links the kernel's BPF library and can load an eBPF program into memory, providing a kernel-level foothold. Windows and macOS builds include anti-debugging checks and persistence mechanisms: a hidden Windows scheduled task that relaunches every minute, and a macOS LaunchAgent that reloads on login. Command-and-control details are encrypted in the binary; runtime monitoring by StepSecurity revealed the binary contacting two hard-coded IP addresses and Tor infrastructure.
jscrambler is a build-time tool often installed as a development dependency or run from CI, placing the stealer in an environment rich with cloud keys, deploy tokens, and source code. The package has about 15,800 weekly downloads; how many pulled the compromised version is unknown. This attack fits a pattern of npm supply-chain incidents since late 2025, including the Shai-Hulud worm and compromises of chalk, debug, and Axios.
Mitigation and Response
Version 8.15.0 has been published from the same maintainer account without the malicious install script, but 8.14.0 remains on npm. Users should immediately move to 8.15.0 or pin to 8.13.0, clear lockfiles and caches, and check for any installation of 8.14.0. If the package ran on a machine, all secrets it could reach—cloud keys, tokens, AI tool API keys, crypto wallets—should be treated as stolen and rotated. Block the two C2 IPs: 37.27.122.124 and 57.128.246.79. The cleanup was fast, but the stealer works in seconds after install, so any machine that ran 8.14.0 has likely already been exfiltrated.