Compromised jscrambler npm package installed a Rust infostealer

The npm ecosystem has seen yet another case of a compromised package. The malicious one turned out to be version 8.14.0 of the jscrambler package, published on July 11, 2026.

How the attack works

Simply installing the compromised release triggers an infostealer. The malicious code fires through the preinstall hook, which downloads and runs a native binary. The attackers prepared separate builds for Windows, macOS and Linux, pointing to a cross-platform focus for the attack.

Discovery

The compromise was flagged by Socket, a company that specializes in monitoring the security of software supply chains. The malicious release was detected just six minutes after it was published to the npm registry, which made it possible to promptly warn the developer community.

What users should do

If jscrambler version 8.14.0 was installed in a project, you need to check your system for infection and update to a safe version. The incident highlights the risks associated with automatically running scripts during npm package installation, and once again demonstrates how vulnerable supply chains are in the JavaScript ecosystem.

Source: The Hacker News