jscrambler npm Package Compromised – Infostealer in 8.14.0
Patch: uninstall jscrambler 8.14.0, install a verified version, and audit package-lock for malicious binaries.
Patch: uninstall jscrambler 8.14.0, install a verified version, and audit package-lock for malicious binaries.
Summary
On July 11, 2026, the npm package jscrambler released version 8.14.0, which was immediately flagged by the security firm Socket. The malicious release contains a preinstall hook that drops a native binary for Windows, macOS, and Linux and executes it automatically. The binary is designed to act as an infostealer, collecting data from the infected machine. The compromise was detected only six minutes after publication, indicating rapid exploitation potential.
Developers who installed jscrambler 8.14.0 are at risk of data exfiltration and should verify package integrity. The incident highlights the importance of auditing third‑party packages and monitoring npm registry activity. Affected users should uninstall the compromised version and revert to a trusted release. The security community is urging immediate action to mitigate the threat.
Key changes
- jscrambler 8.14.0 includes a malicious preinstall hook
- Hook drops a native binary for Windows, macOS, and Linux
- Binary executes automatically, acting as an infostealer
- Release flagged by Socket six minutes after publication
- Compromised package distributed via npm registry
- Potential data exfiltration from infected machines
- No CVE assigned yet, but active exploitation detected
- Recommendation to audit package-lock and verify integrity