{"schemaVersion":"guard-threat-campaign/v1","id":"HGTC-2026-JSCRAMBLER","slug":"jscrambler-npm-package-compromise","title":"jscrambler npm package compromise","aliases":["jscrambler 8.14.0 compromise"],"summary":"Socket documented compromised jscrambler npm releases that introduced hidden native binaries and automatic execution paths, including a preinstall hook in early malicious versions and later import-time execution.","status":"published","severity":"high","confidence":"high","uncertainty":"The attacker changed execution techniques across versions. This record summarizes the reviewed July 11 investigation and does not claim that install-hook controls cover later import-time execution.","firstObservedAt":"2026-07-11T00:00:00.000Z","lastObservedAt":"2026-07-11T18:34:32.000Z","publishedAt":"2026-08-09T11:30:00.000Z","reviewedAt":"2026-08-09T11:20:00.000Z","expiresAt":"2026-09-08T23:59:59.000Z","reviewer":"HOL Guard Research","sources":[{"id":"source:socket-jscrambler","label":"Socket: jscrambler supply-chain attack","url":"https://socket.dev/blog/jscrambler-supply-chain-attack","sourceType":"other_primary","observedAt":"2026-08-09T11:20:00.000Z"}],"artifacts":[{"id":"artifact:jscrambler","artifactClass":"package","ecosystem":"npm","name":"jscrambler","version":"8.14.0 and other affected releases","defanged":true}],"indicators":[],"timeline":[{"id":"timeline:first-observed","occurredAt":"2026-07-11T00:00:00.000Z","eventType":"first_observed","summary":"jscrambler npm package compromise was first observed in the reviewed source material.","sourceIds":["source:socket-jscrambler"]},{"id":"timeline:disclosure","occurredAt":"2026-07-11T18:34:32.000Z","eventType":"disclosure","summary":"The reviewed source published or updated its defensive analysis and remediation guidance.","sourceIds":["source:socket-jscrambler"]}],"coverage":[{"assertionId":"coverage:stable:codex","relationship":"partial","limitation":"A package-install review can reduce exposure to malicious install hooks on eligible paths; import-time execution and machines where the package already ran require additional controls."}],"policies":[{"policyId":"policy:package-install-review","purpose":"Require review or explicit approval for new or changed dependency installation before an eligible package-manager action executes.","status":"available","limitation":"Coverage depends on the active Guard release, package manager, harness event surface, and local policy. It is not a guarantee that every dependency path is intercepted."}],"limitations":["The campaign demonstrates why package-install policy cannot be represented as complete runtime malware prevention."],"correctionHref":"/guard/security/campaigns/jscrambler-npm-package-compromise/corrections"}