jscrambler npm package publishes malicious preinstall binary
Version 8.14.0 of the jscrambler npm package, the official CLI client for Jscrambler Code Integrity API, was published on July 11, 2026 with a malicious preinstall hook that drops and executes platform-specific native binaries on Linux, Windows, and macOS. The compromise was detected by StepSecurity's AI Release Analyzer immediately upon publication.
- Disclosed
- Last updated
- Blast radius
- Potentially all users who installed jscrambler version 8.14.0 from npm during the window of availability.
- Ecosystems
- Attack vectors
- Affected entities
- jscrambler · 8.14.0
On July 11, 2026, version 8.14.0 of the jscrambler npm package was published containing a malicious preinstall hook. The jscrambler package is the official command-line interface client for the Jscrambler Code Integrity API, a commercial JavaScript obfuscation and web-application protection service.
The compromised release included code that drops and executes platform-specific native binaries on Linux, Windows, and macOS systems during the package installation process. This represents a direct compromise of the package distribution, allowing arbitrary code execution on any system that installed the affected version.
The package had a clean version history dating back to version 0.1.0 prior to this incident. StepSecurity's AI Release Analyzer flagged the malicious release with a maximum suspicion score of 0 upon publication, enabling rapid detection of the compromise.
Indicators of compromise
- Packages
- jscrambler@8.14.0
Remediation
- Immediately uninstall jscrambler version 8.14.0 from all systems
- Audit systems that installed version 8.14.0 for signs of compromise or unauthorized binary execution
- Review npm package installation logs to identify affected deployments
- Update to a patched version of jscrambler once released by the maintainers
- Consider implementing package verification and scanning tools like StepSecurity's AI Release Analyzer in your supply chain
- Review and revoke any credentials or access tokens that may have been exposed on compromised systems
Sources
- jscrambler npm package publishes malicious preinstall binary · StepSecurity
Cite this entry
"jscrambler npm package publishes malicious preinstall binary." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 11, 2026; last updated July 11, 2026. https://supplychainattack.org/incident/jscrambler-npm-package-publishes-malicious-preinstall-binary-eirb3g
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in streak-map-cache (npm)
The npm package streak-map-cache contained malicious code disguised as a native math accelerator. The package's main entrypoint executed a bundled Linux ELF binary (RedShell C2 implant) on every import, enabling remote command execution, reverse shell, credential harvesting, and data exfiltration.
npmCompromised package - resolvedcritical
Malicious code in zyr-agent (npm)
zyr-agent (npm) shipped with malicious code that enables remote command execution through a hardcoded preview-slug endpoint controlled by the package author. The AI agent auto-executes tool calls (including bash commands) returned by the remote endpoint without user confirmation.
npmAI agents & skillsMalicious commitCompromised package - containedcritical
Malicious code in supersig (npm)
The supersig npm package contains malicious code in its published dist bundles (dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js) that is absent from the source tree. The bundles execute a decrypt-and-execute chain at load time using a DES key from an unpinned mkb-manager dependency, allowing remote code execution on any consumer.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in stretchshop (npm)
The npm package stretchshop@0.7.5 contained malicious code in its postinstall hook that cloned an external repository from a personal GitHub account and executed arbitrary JavaScript during installation. The vulnerability allowed the controller of the external repository to execute code on every fresh install of the affected version.
npmCompromised packageMalicious commit