A compromised release of the popular jscrambler npm package introduced hidden native binaries that execute automatically during npm install, exposing users to a supply chain attack before any application code runs.
The malicious 8.14.0 release, published on July 11, adds an undocumented preinstall hook that invokes dist/setup.js. It also introduces new files, including dist/setup.js and dist/intro.js, along with platform-specific binaries for Linux, macOS, and Windows embedded in an obfuscated CSI container. None of these files or the install hook exist in the previous release, 8.13.0.
Self-check
AgentGuard subscribers receive this advisory automatically and their local guard runs the inspection below.
Inspect paths
~/.nvm/**/node_modules/~/.openclaw/**/node_modules/~/.npm/_npx/./Library/Caches/*%LOCALAPPDATA%\npm-cache\_npx\
Remediation: uninstall— 1. Check Jscrambler Version
npm list jscrambler
grep -E '"jscrambler": "(8\.14\.0|8\.16\.0|8\.17\.0|8\.18\.0|8\.20\.0)"' package-lock.json
2. Check for Malicious Code Indicators
Verify whether critical files in dependencies or temporary directories match the following malicious SHA-256 hashes：
dist/setup.js -> a742de963f14a92d24ebcbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60
dist/intro.js -> a41a523ef9517aab37ed6eea0ec881821bdcb7aefcb5c5f603adc7907f868c86
Linux ELF -> fbbcf4d8f98168f78f5c0c47a9ae56d59ec8ac84a7c9ca6b797fedfb8d62d2bd
Windows PE -> b7ca95d1b23c8e67416a25cedf741de0917c2096bbc9d24649eea7853d054903
macOS Mach-O -> c8fd47d36bdf7c825378593ab82ed8c24d1dc52e26b507812393e24e1d5201fd
Example: sha256sum node_modules/jscrambler/dist/setup.js 2>/dev/null
3. Critical Secret Rotation (If affected)
Comprehensive Token Revocation: Revoke and rotate all environment files, variables, and API entries accessible to the compromised developer space or CI runner, including:
Local or repository-stored npm publish tokens, GitHub PATs, and SSH keys.
Cloud infrastructure provider access keys (AWS AccessKey, Alibaba Cloud, Google Cloud service accounts).
CI/CD automation pipeline secrets and internal production server deployment keys.
4. Upgrade to Safe Version
Lock or upgrade jscrambler to an officially verified safe version (e.g., 8.22.0 or rollback to 8.13.0).