Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer Durin During Install

Why it matters

A build-time JavaScript protection tool just became a vehicle for stealing the exact secrets that guard your infrastructure. The jscrambler npm package was compromised on July 11, 2026, and simply installing the 8.14.0 release executed a cross-platform Rust infostealer on the developer’s or CI runner’s machine. jscrambler is typically pulled in as a development dependency or run from CI — environments that hold cloud keys, deploy tokens, and source code. Because the payload fires during install, reach is small but the access it captures is maximal: one compromised build host can hand an attacker every credential that process can read.

What happened

The malicious 8.14.0 release added two files not present in the prior 8.13.0: a small setup.js loader and intro.js, a ~7.8MB container packing three gzip-compressed native binaries (Linux, Windows, macOS). On install, setup.js selects the binary for the host OS, drops it under a random name in the system temp directory, marks it executable, and launches it detached with output hidden. The release was pushed straight to npm under a legitimate maintainer account, bypassing the project’s normal release flow — Jscrambler has since confirmed the cause was a compromised npm publishing credential. Socket ties five malicious versions (8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0) to a single actor; in the later two, the dropper moved into the package’s main code, so even npm install --ignore-scripts does not stop it.

Technical details

The stealer sweeps the host for AWS, Azure, and Google Cloud credentials (including CI metadata endpoints), crypto wallets and seed phrases (MetaMask, Phantom, Exodus), the Bitwarden vault, browser-stored passwords and cookies, and Discord, Slack, Telegram, and Steam sessions. It also targets config files for AI coding tools — Claude Desktop, Cursor, Windsurf, VS Code, and Zed — where API keys and Model Context Protocol server credentials live. On Linux the payload links the kernel BPF library and can load an eBPF program into the kernel from memory, a kernel-level foothold. Windows and macOS builds add anti-debugging checks and persistence: a hidden scheduled task relaunching every minute on Windows, and a LaunchAgent on macOS. StepSecurity’s runtime monitoring captured the dropped binary reaching two hard-coded C2 IPs (37.27.122.124 and 57.128.246.79) and Tor infrastructure. Notably, npm 12 shipped on July 8 with install scripts off by default — on that client a preinstall hook like this one does not run unless approved, but older clients still execute them automatically.

Defender actions

If you use jscrambler, move to 8.22.0 (the clean release) and remove any affected version from lockfiles and caches. Audit CI records and package-manager logs for jscrambler@8.14.0/8.16.0/8.17.0/8.18.0/8.20.0 and any run of dist/setup.js since July 11; on Windows inspect Task Scheduler for hidden tasks and on macOS check ~/Library/LaunchAgents for unfamiliar plists. Crucially, if an affected version ran on a machine, treat every secret it could reach as stolen: rotate cloud keys, npm and GitHub tokens, and AI-tool/MCP API keys; revoke Discord, Slack, browser, and Bitwarden sessions; move crypto off the affected wallets; and block the two C2 IPs at the perimeter. 8.22.0 is the agreed clean target per both Jscrambler and Socket.