StepSecurity Analyzes Malicious jscrambler npm Releases Hiding Cross-Platform Payloads
Summary
StepSecurity reports that five jscrambler npm releases contained native payloads that could run during installation or package import. Analysis found browser credential and wallet-storage capabilities; investigation of the full payload remains ongoing.
Key points
- StepSecurity identified jscrambler versions 8.14.0, 8.16.0, 8.17.0, 8.18.0 and 8.20.0 as compromised; releases in the affected range are interleaved with clean versions.
- The releases concealed three platform-specific native binaries in a 7.8 MB file named dist/intro.js. Earlier releases launched the payload through a preinstall hook; later ones ran it when the package was imported.
- StepSecurity’s static analysis found browser credential-store, Chromium storage and BIP39 wordlist components, indicating potential credential and crypto-wallet theft. Full payload analysis is ongoing.
- Harden-Runner monitoring observed outbound calls to archive[.]torproject.org and check[.]torproject.org, and connections to two IP addresses; StepSecurity says it added the endpoints to its block list.
- StepSecurity advises users of affected versions to treat the host as compromised, install a verified clean release, rotate exposed credentials and secrets, and check for the dropped process and file.
Article Details
- Attack Vectors
- Compromised jscrambler npm releases (8.14.0, 8.16.0, and 8.17.0) execute a preinstall hook that extracts and launches a platform-matched native binary; releases 8.18.0 and 8.20.0 instead run the loader when the package is imported.
- The loader extracts a gzip-compressed ELF, PE32+, or Mach-O payload from dist/intro.js to a randomly named file in the system temporary directory and launches it detached from the install process.
- Static analysis found browser credential-store and Chromium Local Storage/IndexedDB capabilities, including components associated with extension wallet storage; the article assesses the payload as a credential and crypto-wallet stealer, while full payload analysis remains ongoing.
- The Linux binary imports libbpf functions for loading an embedded eBPF program; what that program does remains under investigation.
- The Windows and macOS binaries contain debugger-checking imports, and the Windows binary can enumerate active TCP connections and owning process IDs.
- Defensive Notes
- Treat hosts that installed any listed compromised version as compromised; pin to 8.22.0 or another verified clean version rather than using a version range.
- Rotate browser-accessible credentials and secrets exposed to affected CI/CD jobs, including npm tokens, cloud credentials, SSO sessions, and signing keys.
- Move assets from wallets whose extension storage may have been accessible to a new wallet with a freshly generated seed phrase on a clean device.
- Hunt OS temporary directories for randomly named dotfiles matching the described pattern and check for orphaned processes spawned around installation or package-import time.
- Review Harden-Runner network telemetry and block the reported outbound IPs; the article says StepSecurity added the listed endpoints to its global block list.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 37[.]27[.]122[.]124 | Direct outbound connection observed from the dropped malicious binary and added to StepSecurity's global block list. |
| IPV4 | 57[.]128[.]246[.]79 | Direct outbound connection observed from the dropped malicious binary and added to StepSecurity's global block list. |
| SHA256 | b7ca95d1b23c8e67416a25cedf741de0917c2096bbc9d24649eea7853d054903 | SHA-256 of the extracted Windows PE32+ payload from dist/intro.js. |
| SHA256 | c8fd47d36bdf7c825378593ab82ed8c24d1dc52e26b507812393e24e1d5201fd | SHA-256 of the extracted macOS Mach-O arm64 payload from dist/intro.js. |
| SHA256 | fbbcf4d8f98168f78f5c0c47a9ae56d59ec8ac84a7c9ca6b797fedfb8d62d2bd | SHA-256 of the extracted Linux ELF payload from dist/intro.js. |
MITRE ATT&CK
T1059.007 · JavaScriptThe package's JavaScript preinstall loader or inlined module loader extracts and launches the native payload.T1195.002 · Compromise Software Supply ChainThe article reports compromised jscrambler npm releases containing a malicious loader and native payload.T1555.003 · Credentials from Web BrowsersPayload analysis found browser credential-store artifacts and capabilities associated with accessing Chrome and Firefox credential stores.
Vendors
JscramblerOn July 11, 2026, version 8.14.0 of jscrambler was published to npm carrying a malicious preinstall hook that drops and executes a platform-specific native binary on Linux, Windows, and macOS. jscrambler is the officialStepSecurityservice, with a clean version history dating back to 0.1.0. The compromised release was detected by StepSecurity's OSS AI Package Analyst, which flagged it with a suspicion score of 0 (the maximum suspicion rating)
Products
jscramblerOn July 11, 2026, version 8.14.0 of jscrambler was published to npm carrying a malicious preinstall hook that drops and executes a platform-specific native binary on Linux, Windows, and macOS. jscrambler is the officialJscrambler Code Integrity APInative binary on Linux, Windows, and macOS. jscrambler is the official CLI client for the Jscrambler Code Integrity API, a commercial JavaScript obfuscation and web-app protection service, with a clean versionMetaMaskengine, the format Chromium uses for Local Storage and IndexedDB, where browser-extension wallets like MetaMask persist their encrypted vault; and an embedded BIP39 English wordlist, used to parse and validate crypto