Compromised jscrambler npm Release Delivered Cross-Platform Rust Infostealer

Summary

Socket and security researchers reported that jscrambler 8.14.0 contained an install hook that launched a cross-platform Rust infostealer targeting developer secrets. The release remains available; the account or pipeline compromise is unresolved.

Key points

The jscrambler 8.14.0 release, published July 11, added files absent from the public source repository and was reportedly pushed through a legitimate maintainer account; whether the account or build pipeline was compromised is unknown.
Its preinstall loader selects a Windows, macOS, or Linux binary, writes it to a randomly named temporary file, and launches it detached.
The infostealer targets cloud credentials, wallets, password-manager data, browser credentials and sessions, developer tokens, and AI coding tool and MCP configuration credentials.
Researchers reported that the Linux payload can load an eBPF program into the kernel; Windows and macOS builds include anti-debugging checks and persistence mechanisms. The eBPF program's behavior remains under investigation.
StepSecurity runtime monitoring observed connections to two command-and-control IP addresses and Tor infrastructure; the number of affected installations is unknown.
Version 8.14.0 remains available and may still install from lockfiles or caches. The article advises upgrading to 8.15.0 or pinning 8.13.0, checking for execution, and rotating or revoking secrets accessible to affected machines.

Article Details

Attack Vectors: The jscrambler 8.14.0 npm release was published with a malicious preinstall hook that selected and executed a native payload for the host operating system.
The release was pushed to npm from a legitimate maintainer account outside the project’s normal release flow; whether the account or build pipeline was compromised was not established.
The infostealer collected developer secrets, cloud credentials, wallet data, browser passwords and cookies, application sessions, and AI coding tool and MCP configuration credentials, then sent data to a drop server over TLS.
The Windows build created a hidden scheduled task that relaunches every minute; the macOS build installed a LaunchAgent that reloads on login.
The Windows and macOS builds included anti-debugging checks. The Linux payload could load an eBPF program into the kernel, but its behavior was still under analysis.
Defensive Notes: Move from jscrambler 8.14.0 to 8.15.0 or pin to 8.13.0; remove 8.14.0 from lockfiles and caches.
Check lockfiles and package-manager logs for [email protected] and CI records for runs of dist/setup.js from July 11, 2026 onward.
Investigate install timestamps, Node child processes, and execution from temporary directories; check Windows Task Scheduler for hidden tasks and macOS ~/Library/LaunchAgents for unfamiliar plists.
If 8.14.0 ran, treat accessible secrets as stolen: rotate cloud keys, npm and GitHub tokens, and AI-tool and MCP API keys; revoke relevant sessions and move cryptocurrency from wallets on the host.
Block the two C2 IP addresses listed in the article. The article notes that npm 12 disables dependency install scripts by default unless approved, while older clients still run them automatically.

Indicators of compromise

Type	Indicator	Context
IPV4	`37[.]27[.]122[.]124`	Direct attacker C2 IP address contacted by the dropped binary at runtime, according to StepSecurity.
IPV4	`57[.]128[.]246[.]79`	Direct attacker C2 IP address contacted by the dropped binary at runtime, according to StepSecurity.
SHA256	`a41a523ef9517aab37ed6eea0ec881821bdcb7aefcb5c5f603adc7907f868c86`	SHA-256 of dist/intro.js, the file containing the compressed native payloads in the malicious release.
SHA256	`a742de963f14a92d24ebcbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60`	SHA-256 of dist/setup.js, the malicious loader added to jscrambler 8.14.0.
SHA256	`b7ca95d1b23c8e67416a25cedf741de0917c2096bbc9d24649eea7853d054903`	SHA-256 of the Windows infostealer payload.
SHA256	`c8fd47d36bdf7c825378593ab82ed8c24d1dc52e26b507812393e24e1d5201fd`	SHA-256 of the macOS infostealer payload.
SHA256	`fbbcf4d8f98168f78f5c0c47a9ae56d59ec8ac84a7c9ca6b797fedfb8d62d2bd`	SHA-256 of the Linux infostealer payload.

MITRE ATT&CK

T1005 · Data from Local SystemThe payload collected credentials, wallet data, browser data, and application sessions from the infected developer machine.T1041 · Exfiltration Over C2 ChannelThe infostealer sent collected data to a drop server over TLS.T1053.005 · Scheduled TaskThe Windows payload established persistence with a hidden scheduled task configured to relaunch every minute.T1059.007 · JavaScriptThe package’s preinstall hook runs setup.js, which selects and launches the host-specific native payload.T1195.002 · Compromise Software Supply ChainThe malicious jscrambler 8.14.0 package was published to npm through a legitimate maintainer account outside the normal release flow; compromise of the account or build pipeline was not established.T1539 · Steal Web Session CookieThe infostealer collected browser cookies and sessions.T1543.001 · Launch AgentThe macOS payload established persistence with a LaunchAgent that reloads on login.T1552.001 · Credentials In FilesThe infostealer searched local developer and AI-tool configuration files for secrets, API keys, and MCP credentials.T1552.005 · Cloud Instance Metadata APIThe infostealer targeted cloud credentials, including metadata endpoints used by CI runners.T1555.003 · Credentials from Web BrowsersThe infostealer targeted passwords stored by browsers.T1555.005 · Password ManagersThe infostealer targeted the Bitwarden password manager vault.T1622 · Debugger EvasionThe Windows and macOS builds included anti-debugging checks.

Products

BitwardenCI runners use; cryptocurrency wallets and seed phrases from MetaMask, Phantom, and Exodus; the Bitwarden password manager vault; browser-stored passwords and cookies; and Discord, Slack, Telegram, and Steam Claude DesktopIt also goes after something newer: the config files for AI coding tools, including Claude Desktop, Cursor, Windsurf, VS Code, and Zed, where API keys and Model Context Protocol server credentials tend to sit.CursorIt also goes after something newer: the config files for AI coding tools, including Claude Desktop, Cursor, Windsurf, VS Code, and Zed, where API keys and Model Context Protocol server credentials tend to sit.jscramblerThe jscrambler npm package version 8.14.0 was compromised with a preinstall hook that drops a Rust infostealer for Windows, macOS, and Linux, targeting developer secrets, cloud credentials, wallets, and AI tool config npmThe jscrambler npm package version 8.14.0 was compromised with a preinstall hook that drops a Rust infostealer for Windows, macOS, and Linux, targeting developer secrets, cloud credentials, wallets, and AI tool config VS CodeIt also goes after something newer: the config files for AI coding tools, including Claude Desktop, Cursor, Windsurf, VS Code, and Zed, where API keys and Model Context Protocol server credentials tend to sit.WindsurfIt also goes after something newer: the config files for AI coding tools, including Claude Desktop, Cursor, Windsurf, VS Code, and Zed, where API keys and Model Context Protocol server credentials tend to sit.ZedIt also goes after something newer: the config files for AI coding tools, including Claude Desktop, Cursor, Windsurf, VS Code, and Zed, where API keys and Model Context Protocol server credentials tend to sit.