jscrambler npm Supply Chain Compromise: Native Binary Infostealer Injection

title: Potential Malicious NPM Preinstall Execution
date: 2026/07/13
description: Detects execution of npm preinstall scripts that may be used for supply chain attacks. status: experimental
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/62f3a1c2b3d4e5f6a7b8c9d0
tags:
    - attack.initial_access
    - attack.t1195.002
falsepositives:
    - Legitimate build scripts requiring preinstall hooks
level: high
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\npm.cmd'
        CommandLine|contains: 'preinstall'
    condition: selection
---
title: Suspicious Binary Drop by NPM Process
date: 2026/07/13
description: Detects child processes spawned by npm that are not standard node/javascript interpreters, indicating potential native payload execution.
status: experimental
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/62f3a1c2b3d4e5f6a7b8c9d0
tags:
    - attack.execution
    - attack.t1059
falsepositives:
    - Legitimate native node modules (node-gyp)
level: high
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\npm.cmd'
            - '\node.exe'
    selection_child:
        Image|endswith:
            - '.exe'
            - '.dll'
        Image|notcontains:
            - 'node.exe'
            - 'cmd.exe'
            - 'powershell.exe'
    condition: all of selection_*
---
title: Jscrambler Compromised Package Installation
date: 2026/07/13
description: Detects the specific installation of the compromised jscrambler package version 8.14.0.
status: experimental
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/62f3a1c2b3d4e5f6a7b8c9d0
tags:
    - attack.initial_access
    - attack.supply_chain
falsepositives:
    - None (Specific to compromised version)
level: critical
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'jscrambler@8.14.0'
    condition: selection

// Hunt for process execution related to the jscrambler compromise
DeviceProcessEvents
| where Timestamp > ago(3d)
| where ProcessCommandLine has "jscrambler" and ProcessCommandLine has "8.14.0"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend IoC = "Compromised Package Version"
;
// Hunt for child processes spawned by npm that are not node.exe (Native Binary Execution)
DeviceProcessEvents
| where Timestamp > ago(3d)
| where InitiatingProcessFileName == "npm.cmd" or InitiatingProcessFileName == "node.exe"
| where not(FileName has "node.exe" or FileName has "cmd.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, InitiatingProcessCommandLine
| where isnotempty(SHA256)

# IOC Hunter for Jscrambler Compromise v8.14.0
# Checks for the presence of the package and the malicious binary hashes

$MaliciousHashes = @(
    "a41a523ef9517aab37ed6eea0ec881821bdcb7aefcb5c5f603adc7907f868c86",
    "a742de963f14a92d24ebcbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60",
    "b7ca95d1b23c8e67416a25cedf741de0917c2096bbc9d24649eea7853d054903",
    "bba32ddeab075a5e5015eec50f5d2af364c95b848732c714aea6b6baf78f49f0",
    "c8fd47d36bdf7c825378593ab82ed8c24d1dc52e26b507812393e24e1d5201fd",
    "fbbcf4d8f98168f78f5c0c47a9ae56d59ec8ac84a7c9ca6b797fedfb8d62d2bd"
)

Write-Host "[*] Scanning for jscrambler v8.14.0 in node_modules directories..."

# Search for package. files containing jscrambler version 8.14.0
$Paths = Get-ChildItem -Path "C:\" -Filter "package." -Recurse -ErrorAction SilentlyContinue | 
          Where-Object { $_.DirectoryName -match "node_modules" }

foreach ($Path in $Paths) {
    $Content = Get-Content $Path.FullName -Raw -ErrorAction SilentlyContinue
    if ($Content -match '"jscrambler"\s*:\s*"\^?8\.14\.0"') {
        Write-Host "[!] FOUND COMPROMISED PACKAGE:" $Path.FullName -ForegroundColor Red
        
        # Check for dist/setup.js
        $SetupPath = Join-Path $Path.DirectoryName "dist\setup.js"
        if (Test-Path $SetupPath) {
            Write-Host "[!] FOUND setup.js:" $SetupPath -ForegroundColor Red
        }
    }
}

Write-Host "[*] Scanning file system for known malicious hashes..."

# Scan recent files in user directories and common temp locations
$Drives = @("C:\Users\", "C:\temp\")
foreach ($Drive in $Drives) {
    $Files = Get-ChildItem -Path $Drive -File -Recurse -ErrorAction SilentlyContinue | 
             Where-Object { $_.Length -gt 0kb -and $_.Length -lt 10MB }
    
    foreach ($File in $Files) {
        $Hash = (Get-FileHash -Path $File.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($MaliciousHashes -contains $Hash) {
            Write-Host "[!!!] MALICIOUS FILE DETECTED:" $File.FullName -ForegroundColor Red
            Write-Host "     Hash:" $Hash
        }
    }
}