Compromised jscrambler 8.14.0: Rust Infostealer Detection and Remediation

---
title: Installation of Malicious jscrambler npm Package 8.14.0
id: 9c8f7d6e-5b4a-4c3d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects the installation of the compromised jscrambler package version 8.14.0 via npm CLI.
references:
  - https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html
author: Security Arsenal
date: 2026/07/11
tags:
  - attack.initial_access
  - attack.supply_chain
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\npm.cmd'
    CommandLine|contains:
      - 'jscrambler'
      - '8.14.0'
  condition: selection
falsepositives:
  - Legitimate testing of the specific package version (unlikely given the context)
level: critical
---
title: Suspicious Native Binary Spawned by npm preinstall Hook
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects npm or node spawning a native executable outside of standard build tools, indicative of the jscrambler infostealer behavior.
references:
  - https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html
author: Security Arsenal
date: 2026/07/11
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
    Image|endswith:
      - '.exe'
  filter_legit_tools:
    Image|contains:
      - '\git\'
      - '\python\'
      - '\mingw64\'
      - '\cmake\'
      - '\node_modules\node-gyp\'
  condition: selection and not filter_legit_tools
falsepositives:
  - Custom build scripts invoking native binaries
level: high

// Hunt for jscrambler 8.14.0 installation and suspicious child processes
let TimeFrame = ago(7d);
DeviceProcessEvents
| where Timestamp >= TimeFrame
| where ProcessCommandLine has "jscrambler" and ProcessCommandLine has "8.14.0"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FolderPath, InitiatingProcessFileName
| union (
    DeviceProcessEvents
    | where Timestamp >= TimeFrame
    | where InitiatingProcessFileName in ("node.exe", "npm.cmd")
    | where ProcessCommandLine has "node_modules" 
    | where not(ProcessCommandLine has_any("node-gyp", "webpack", "vite", "ts-node", "jest")) 
    | where FileName endswith ".exe" // Focus on Windows executables
)
| distinct Timestamp, DeviceName, AccountName, ProcessCommandLine, FileName, InitiatingProcessFileName
| sort by Timestamp desc

-- Hunt for jscrambler 8.14.0 package. and suspicious binaries
LET PackageSearch = SELECT FullPath
FROM glob(globs="/*/node_modules/jscrambler/package.")

LET SuspiciousBins = SELECT FullPath, Size, Mtime
FROM glob(globs="/*/node_modules/jscrambler/dist/**/*.exe")  // Adjust path based on actual tarball structure, checking executables
WHERE Size > 100000 // Heuristic: ensure we are looking at actual binaries, not small scripts

SELECT 
  PackageSearch.FullPath AS PackagePath,
  read_file(filename=PackageSearch.FullPath) AS Content,
  "Found jscrambler package" AS Message
FROM PackageSearch
WHERE Content =~ "8\.14\.0"

UNION ALL

SELECT 
  FullPath AS BinaryPath,
  Size,
  Mtime,
  "Suspicious binary in package" AS Message
FROM SuspiciousBins

<#
.SYNOPSIS
  Remediation script for compromised jscrambler 8.14.0 npm package.
.DESCRIPTION
  Scans for node_modules, checks for jscrambler version 8.14.0, and removes the malicious directory.
  Generates a report of findings.
#>

$ErrorActionPreference = "Stop"
$LogPath = "$env:SystemDrive\Temp\jscrambler_remediation_$(Get-Date -Format 'yyyyMMddHHmmss').log"

function Write-Log {
    param ([string]$message)
    Write-Output "$(Get-Date -Format o): $message" | Out-File -FilePath $LogPath -Append
    Write-Host $message
}

Write-Log "Starting remediation scan for jscrambler 8.14.0..."

# Find all package. files to locate project roots
$packageFiles = Get-ChildItem -Path $env:SystemDrive\ -Filter "package." -Recurse -ErrorAction SilentlyContinue

$foundThreats = 0

foreach ($file in $packageFiles) {
    try {
        $content = Get-Content $file.FullName -Raw -ErrorAction Stop
        
        # Check if jscrambler is a dependency (simplified JSON parsing for robustness)
        if ($content -match '"jscrambler"\s*:\s*"([^"]+)"' -or $content -match '"jscrambler"\s*:\s*\{[^}]*"version"\s*:\s*"([^"]+)"') {
            $version = $matches[1]
            
            if ($version -eq "8.14.0") {
                Write-Log "[THREAT] Malicious version 8.14.0 found in $($file.DirectoryName)"
                $foundThreats++
                
                # Determine path to node_modules/jscrambler
                $jscramblerPath = Join-Path -Path $file.DirectoryName -ChildPath "node_modules\jscrambler"
                
                if (Test-Path $jscramblerPath) {
                    Write-Log "[ACTION] Removing malicious directory: $jscramblerPath"
                    Remove-Item -Path $jscramblerPath -Recurse -Force -ErrorAction Stop
                    Write-Log "[SUCCESS] Directory removed."
                } else {
                    Write-Log "[INFO] Directory not found (may not have been installed yet)."
                }
            }
        }
    } catch {
        Write-Log "[ERROR] Processing file $($file.FullName): $_"
    }
}

if ($foundThreats -eq 0) {
    Write-Log "No instances of jscrambler 8.14.0 found."
} else {
    Write-Log "Remediation complete. Found and acted on $foundThreats instances."
    Write-Host "Review logs at $LogPath"
}