6 minutes. Not the problem.
Jscrambler's compromised 8.14.0 npm release dropped a Rust infostealer during install, affecting Windows, macOS, and Linux users. The preinstall hook executed a native binary, highlighting the vulnerability of supply chains.
This incident reveals what everyone reads as a "package problem" is actually a third-party assurance failure. 42% of exploited vulnerabilities in 2025 were weaponized before public disclosure, according to the CrowdStrike Global Threat Report 2026.
The defensive math: -> Review all npm packages for similar preinstall hooks, focusing on those with native binary execution capabilities -> Implement a vendor risk management program to assess the security posture of third-party dependencies -> Monitor for suspicious activity related to the jscrambler package, using industry benchmarks like the 29-minute average breakout time as a baseline
Can your organization detect a malicious npm package install within 6 minutes?