Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install

Version 8.14.0 of the jscrambler npm package, published on July 11, 2026, shipped with a malicious preinstall hook that silently drops and runs a native Rust infostealer during installation. The package, which is a build-time tool used as a development dependency or in CI, targets Windows, macOS, and Linux systems. The hook fires before the package is set up, and the payload is not present in the prior release 8.13.0.

The package diff reveals two new files: setup.js (a loader) and intro.js (a 7.8MB container with gzip-compressed native binaries). On install, setup.js selects the appropriate binary for the host OS, writes it to the system temp directory, and launches it with hidden output. The added files are not in jscrambler’s public source code, and no matching commit or tag exists for 8.14.0 in the GitHub repository, indicating a compromised npm account or build pipeline.

The Rust infostealer sweeps developer machines for secrets, targeting cloud credentials (AWS, Azure, Google Cloud), cryptocurrency wallets (MetaMask, Phantom, Exodus), Bitwarden password manager vaults, browser-stored passwords and cookies, and session tokens for Discord, Slack, Telegram, and Steam. It also targets config files for AI coding tools like Claude Desktop, Cursor, Windsurf, VS Code, and Zed. On Linux, the payload can load an eBPF program into the kernel for persistence. Windows and macOS builds include anti-debugging checks and persistence mechanisms (hidden scheduled task on Windows, LaunchAgent on macOS). The command-and-control details are encrypted, but runtime monitoring revealed connections to two hard-coded IP addresses and Tor infrastructure.

Socket flagged the release six minutes after publication. The package sees about 15,800 weekly downloads. Version 8.15.0 has since been published without malware, but 8.14.0 remains on npm. Users should immediately move to 8.15.0 or pin to 8.13.0, rotate all exposed secrets, and block the C2 IPs.