Popular JS Obfuscator jscrambler Compromised

Threat Intel
,
1

Last Updated: 2026-07-12T12:51:42Z

What’s Happening

jscrambler, a popular JavaScript obfuscation library, has been compromised with stealer malware.

Socket reports that the compromised versions begin with 8.14. The malware seeks common secret-containing files, including cryptocurrency wallets, SSH key libraries, AI configuration folders, cloud configuration folders, and even Steam configs.

All detected compromised version:

  • 8.14
  • 8.16
  • 8.17
  • 8.18
  • 8.20

Those are not typos. 8.15 and 8.19 do not appear compromised.

Step Security notes that the malware appears to embed eBPF libraries, suggesting a Linux persistence mechanism that may go beyond simple one-time theft. Analysis of the eBPF code is ongoing.

Actions

As with all compromised packages, audit your environment for the presence of this package and these versions. If found, commence incident response on affected devices, and rotate all relevant secrets.

See the linked reports for indicators of compromise.

Notes

Socket’s writeup notes every string is encrypted with ChaCha20-Poly1305. That’s impressive operational security for a stealer. Embedding libbpf.so for Linux activities is also rare, but not unheard of.

1 Like