Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install The jscrambler npm package was compromised, and simply installing its 8.14.0 release runs an infostealer on your machine. Published on July 11, 2026, the malicious version carries a preinstall hook that drops and executes a native binary, one build each for Windows, macOS, and Linux. Socket flagged the release six minutes after it was published. If you or one of your Com…

https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html

sha256:082c8c782e80704fee24a937956d6d8349add7acbe2ded5ec4ec7b6e53891f58

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md50
url0
ipv42
ipv60
sha10
domain2
sha2565
malware_token1
attack_pattern0
threat_actor_token1

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
ip	37.27.122.124	Open →
ip	57.128.246.79	Open →
domain	check.torproject.org	Open →
domain	archive.torproject.org	Open →
sha256	a742de963f14a92d24ebcbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60	Open →
sha256	a41a523ef9517aab37ed6eea0ec881821bdcb7aefcb5c5f603adc7907f868c86	Open →

Malware families

Allowlist token matches only.

Metasploitmalware-family

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

Scattered Spider

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports