Compromised jscrambler npm Package Drops Infostealer
Version 8.14.0 executes a data-stealing malware during installation.
1Critical Security Flaw in jscrambler Package
The 8.14.0 release of jscrambler on npm contained malicious code. A preinstall hook executed a platform-specific infostealer during installation. This bypassed the project's normal release flow, suggesting a compromised npm account or build pipeline.
2How It Works
The malware introduced two new files: setup.js and intro.js. intro.js was a container holding compressed binaries for Linux, Windows, and macOS. During installation, setup.js would extract and execute the appropriate binary with the user's permissions, writing it to a temporary directory under a random name.
3Data Targeted by the Stealer
The infostealer targeted developer credentials including cloud service keys (AWS, Azure, Google Cloud), cryptocurrency wallets, password manager vaults, browser data, and messaging app sessions. It also sought API keys from AI coding tools like VS Code and Claude Desktop.
4Kernel-Level Access on Linux
The Linux variant linked with the kernel's BPF library to load an eBPF program directly into memory, gaining kernel-level access beyond typical user-space file operations. Windows and macOS versions included anti-debugging checks and persistence mechanisms.
5Discovery and Analysis
Socket flagged the package six minutes after publication. StepSecurity and SafeDep confirmed no matching GitHub commit or tag existed for version 8.14.0. The package was pushed directly to npm under a legitimate maintainer account, circumventing standard release protocols.
6Impact and Mitigation
With ~15,800 weekly downloads, the exact number of affected systems remains unknown. npm 12 had recently disabled dependency install scripts by default, but older clients remained vulnerable. Version 8.15.0 was released clean, but 8.14.0 remains available on npm.
7Recommended Actions
Immediately upgrade to 8.15.0 or revert to 8.13.0. Remove [email protected] from lockfiles and caches. Check installation logs for any execution of dist/setup.js. Rotate all potentially exposed credentials, including cloud keys and API tokens.
8Broader Implications
This incident highlights persistent security challenges in the npm ecosystem. Developers must enhance dependency management practices, particularly for CI/CD environments. Proactive security measures and runtime monitoring are becoming essential in modern software development workflows.
Original article: The Hacker News — jscrambler npm Paketiyle Gelen Güvenlik İhlali