Poisoned Pipeline / Incidents / AS51
jscrambler@8.14.0 preinstall native binaries
Socket detected a compromised jscrambler 8.14.0 six minutes after
publication on 11 July 2026 (~15.8k weekly downloads). An undocumented
preinstall hook runs dist/setup.js and executes a platform-specific
native binary (Linux, macOS, Windows) from an obfuscated CSI container.
Those files do not exist in 8.13.0. Install is enough; no import or CLI
required. High risk for CI that uses Jscrambler on production builds.
Mapped techniques
- T0121 Compromised legitimate artifact
- T0151 Installation scripts
- T0140 Harvest tokens from environment variables
supply-chain jscrambler on npm
Popular JS protection tool under its real name.
preinstall invokes hidden native binaries.
Binary runs with access to source, env, and CI credentials.