A compromised release of the popular jscrambler npm package introduced hidden native binaries that execute automatically during npm install.

The malicious 8.14.0 release adds an undocumented preinstall hook that invokes dist/setup.js. It also introduces platform-specific binaries embedded in an obfuscated CSI container.

Impact

Simply installing jscrambler@8.14.0 is enough to trigger the bundled platform-specific binary. Users do not need to import the package or run the CLI.

Technical Analysis

The compromised version ships two malicious files under dist/.

  1. Reads the container.
  2. Selects the blob matching process.platform.
  3. Launches the native executable in the background.

Indicators of Compromise