registry / Malware / jscrambler

jscrambler

this package was compromised

Jscrambler Code Integrity API client.

This report shows the evidence for jscrambler@8.14.0. 4 of 9 known versions are blocked or flagged. The newest version, 8.22.2, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The preinstall hook performs stealthy, unconsented execution of opaque native binaries rather than package setup. This is a concrete malware delivery chain, not a user-invoked CLI capability.

Static reason

One or more suspicious static signals were detected.

Trigger

npm preinstall

Impact

Unconsented arbitrary native code execution during dependency installation

Mechanism

opaque native payload extraction and detached execution

Attack narrative

`npm install` invokes `dist/setup.js` before normal package use. It parses the opaque `dist/intro.js` bundle, selects a platform payload, writes it under a randomized dot-prefixed temporary filename, sets executable permissions on non-Windows systems, and starts it detached with output ignored. The embedded data contains native ELF and Windows PE payloads, so its behavior cannot be validated from the JavaScript API-client source and is executed without user action.

AI rationale

The preinstall hook performs stealthy, unconsented execution of opaque native binaries rather than package setup. This is a concrete malware delivery chain, not a user-invoked CLI capability.

Evidence

package.jsondist/setup.jsdist/intro.js

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

`package.json` runs `node dist/setup.js` at `preinstall`.
`dist/setup.js` reads opaque 7.5 MB `dist/intro.js` during installation.
`dist/setup.js` decompresses platform payloads into a random hidden temp filename.
`dist/setup.js` marks non-Windows payloads executable and spawns them detached with ignored stdio.
The first bundled payload decompresses to an ELF executable; another decompresses to an MZ Windows executable.

Evidence against

The documented CLI client uses the package-aligned `api4.jscrambler.com` API only when invoked/configured.
No JavaScript source outside `dist/setup.js` performs install-time child-process execution.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

3 flagged

package.jsonView file

•scripts.preinstall = node dist/setup.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/client.jsView file

2L3: require("core-js/modules/es.regexp.exec.js"); L4: require("core-js/modules/es.string.replace.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client.jsView on unpkg · L2

dist/intro.jsView file

•path = dist/intro.js kind = oversized_source_file sizeBytes = 7837238 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/intro.jsView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.preinstall = node dist/setup.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/client.jsView file

2L3: require("core-js/modules/es.regexp.exec.js"); L4: require("core-js/modules/es.string.replace.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client.jsView on unpkg · L2

dist/intro.jsView file

•path = dist/intro.js kind = oversized_source_file sizeBytes = 7837238 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

Findings

2 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filedist/intro.js

MediumDynamic Requiredist/client.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to jscrambler@8.14.0.

The versions list below shows the verdict for each recorded version.

Avoid installing jscrambler@8.14.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-13 01:09:03.676Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

9 known versions

8.22.2latestUnknown—AllowUnder ReviewOct 1, 2026, 5:45 PM 8.22.1Clean—AllowPublishedSep 8, 2026, 12:31 PM 8.20.0MaliciousMalwareBlockPublishedJul 11, 2026, 5:53 PM 8.18.0MaliciousMalwareBlockPublishedJul 11, 2026, 5:46 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

Other malware packages