jscrambler 8.14.0 npm Package Compromised: Supply Chain Attack Details
Version 8.14.0 of the jscrambler npm package was compromised, shipping with a malicious preinstall hook that drops and runs a native infostealer during installation. Users of this version are advised to audit and rotate any secrets in affected environments.
What happened
Version 8.14.0 of the jscrambler npm package, released on July 11, 2026, contained a malicious preinstall hook. This hook silently dropped and executed a native infostealer binary during installation, with builds available for Windows, macOS, and Linux. The compromised package was flagged by Socket within six minutes of its release.
The malicious version introduced two new files: setup.js, a small loader script, and intro.js, a 7.8MB container holding gzip-compressed native binaries for the three operating systems. On installation, setup.js selects the appropriate binary for the host OS, writes it to a temporary directory, marks it executable, and launches it detached.
StepSecurity and SafeDep analyzed the release and found no corresponding commit, tag, or pull request in the jscrambler GitHub repository. The latest legitimate tag remains 8.13.0. The compromised version was pushed directly to npm under a legitimate maintainer account, indicating a potential compromise of the npm account or build pipeline. Users are advised to avoid version 8.14.0 and audit any environments where it may have been installed.
How 0Day mitigates this
jscrambler is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.