jscrambler npm package compromise
Direct answer
jscrambler npm package compromise, also tracked as jscrambler 8.14.0 compromise is a high-severity threat campaign HOL Guard tracked from Jul 11, 2026 to Jul 11, 2026, verified against 1 primary source and last reviewed Sep 2, 2026. Active tracking has ended and the record remains published as a permanent historical research record.
Socket documented compromised jscrambler npm releases that introduced hidden native binaries and automatic execution paths, including a preinstall hook in early malicious versions and later import-time execution.
Also tracked as jscrambler 8.14.0 compromise
- First observed
- Jul 11, 2026
- Last observed
- Jul 11, 2026
- Last reviewed
- Sep 2, 2026
- Tracking ended
- Sep 8, 2026
Record exports
Uncertainty and limitations
Read the evidence limits before acting on this record.
The attacker changed execution techniques across versions. This record summarizes the reviewed July 11 investigation and does not claim that install-hook controls cover later import-time execution.
- The campaign demonstrates why package-install policy cannot be represented as complete runtime malware prevention.
Guard coverage and policy
What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.
Not covered, or partially covered
partial
A package-install review can reduce exposure to malicious install hooks on eligible paths; import-time execution and machines where the package already ran require additional controls.
- Recipe available
Require review or explicit approval for new or changed dependency installation before an eligible package-manager action executes.
Coverage depends on the active Guard release, package manager, harness event surface, and local policy. It is not a guarantee that every dependency path is intercepted.
Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
Timeline
Reviewed events, oldest first, each tied to a verified source.
- First observed
jscrambler npm package compromise was first observed in the reviewed source material.
- Disclosure
The reviewed source published or updated its defensive analysis and remediation guidance.
Publication clock: 688.9 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; historical backfill outside target.
Reviewed artifacts
The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.
jscrambler@8.14.0 and other affected releasesnpmpackage
Sources
Every claim on this record is traceable to the sources below.
Campaign questions, answered
Socket documented compromised jscrambler npm releases that introduced hidden native binaries and automatic execution paths, including a preinstall hook in early malicious versions and later import-time execution. HOL Guard tracked the campaign from Jul 11, 2026 to Jul 11, 2026.
No. Active tracking ended Sep 8, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.
The record cites 1 primary source, names 1 reviewed artifact, and was last fully reviewed Sep 2, 2026 by HOL Guard Research. Its uncertainty and limitations are stated on the record itself.
Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage. The campaign-specific policy starting point is linked from the coverage section of this record.
The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. The attacker changed execution techniques across versions. This record summarizes the reviewed July 11 investigation and does not claim that install-hook controls cover later import-time execution.
Record HGTC-2026-JSCRAMBLER