jscrambler 8.14.0 npm release injects Rust infostealer via preinstall hook with eBPF kernel access

The malicious release added setup.js and intro.js under dist/ with no matching GitHub commit or tag; the version bypassed normal release flow and was pushed directly to npm under a maintainer account. Socket detected the package six minutes after publication while StepSecurity and SafeDep confirmed the binaries contained platform-specific builds for Windows, macOS, and Linux plus anti-debugging and persistence mechanisms including scheduled tasks and LaunchAgents. The stealer harvested AWS, Azure, GCP metadata credentials, browser wallets, AI tool configs, and shipped data over TLS to two hardcoded IPs plus Tor nodes.

This incident follows the Shai-Hulud worm pattern of install-hook execution but shifts to native Rust payloads with kernel footholds rather than JavaScript token theft. The broad targeting of CI-accessible secrets and newer AI coding tool configs indicates attackers prioritize build environments over end-user machines. No public evidence distinguishes between npm account takeover versus pipeline compromise, leaving the exact initial vector unresolved.

Reach was modest at roughly 15,800 weekly downloads yet sufficient for high-value access; the six-minute detection window still allowed execution on any pulled systems. Future packages using similar preinstall native loaders will likely evade static npm scanners until runtime telemetry is standard.

Maintainers should pin to 8.13.0 and audit all recent installs; expect renewed focus on supply-chain signing and reproducible builds within the next quarter.