--- title: jscrambler npm Package Compromised in Supply Chain Attack description: The jscrambler npm package version 8.14.0 was compromised in a supply chain attack published on July 11, 2026. The malicious release added an undocumented... canonical: https://daily.dev/posts/jscrambler-npm-package-compromised-in-supply-chain-attack-qinps6h0j twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: jscrambler npm Package Compromised in Supply Chain Attack | daily.dev og:description: The jscrambler npm package version 8.14.0 was compromised in a supply chain attack published on July 11, 2026. The malicious release added an undocumented... og:url: https://daily.dev/posts/jscrambler-npm-package-compromised-in-supply-chain-attack-qinps6h0j og:image: https://api.daily.dev/og/posts/qINPS6h0J.png og:image:alt: jscrambler npm Package Compromised in Supply Chain Attack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # jscrambler npm Package Compromised in Supply Chain Attack **[Socket](https://daily.dev/sources/socketdev)** · 3 min read · 0 upvotes · 0 comments ## Summary The jscrambler npm package version 8.14.0 was compromised in a supply chain attack published on July 11, 2026. The malicious release added an undocumented preinstall hook that automatically executes hidden native binaries for Linux, macOS, and Windows during npm install — before any application code runs. The binaries are embedded in an obfuscated CSI container. While static analysis did not reveal obvious C2, credential theft, or cryptomining behavior, the attack exposes developer workstations, CI environments, and build pipelines to potential access of source code, environment variables, and deployment secrets. Socket detected the compromised version 6 minutes after publication. Users are advised to remove 8.14.0, rotate credentials, and pin to 8.13.0 until a clean release is available. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Hackers backdoor Jscrambler npm package with infostealer malware](https://daily.dev/posts/hackers-backdoor-jscrambler-npm-package-with-infostealer-malware-blf8gd33m) · BleepingComputer · 2 upvotes · 0 comments - [jscrambler npm package publishes malicious preinstall binary](https://daily.dev/posts/jscrambler-npm-package-publishes-malicious-preinstall-binary-hv0avwili) · StepSecurity · 2 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#javascript](https://daily.dev/tags/javascript), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/jscrambler-npm-package-compromised-in-supply-chain-attack-qinps6h0j) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"jscrambler npm Package Compromised in Supply Chain Attack","url":"https://daily.dev/posts/jscrambler-npm-package-compromised-in-supply-chain-attack-qinps6h0j","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/jscrambler-npm-package-compromised-in-supply-chain-attack-qinps6h0j"},"datePublished":"2026-07-11T17:04:43.927Z","dateModified":"2026-07-11T17:05:05.829Z","description":"The jscrambler npm package version 8.14.0 was compromised in a supply chain attack published on July 11, 2026. The malicious release added an undocumented...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d860650b667e5a94c39d8ebd04bf978a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d860650b667e5a94c39d8ebd04bf978a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/jscrambler-npm-package-compromised-in-supply-chain-attack-qinps6h0j","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,javascript,npm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"jscrambler npm Package Compromised in Supply Chain Attack"}]} ```