jscrambler npm package publishes malicious preinstall binary

On July 11, 2026, a malicious version (8.14.0) of the jscrambler npm package was published, containing a preinstall hook that drops and executes a platform-specific native binary on Linux, Windows, and macOS. The payload, hidden inside a file named dist/intro.js with a custom magic header, is a Rust-compiled binary designed to steal browser credentials and cryptocurrency wallet data. The attack leverages kernel-level capabilities on Linux via eBPF, anti-analysis techniques on Windows and macOS, and communicates with known malicious domains and IPs. The compromised package represents a high-impact supply chain attack targeting development and CI/CD environments.

AI-extracted · verify before operational use