Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan

On July 28, 2026, malicious beta versions of the npm packages @joyfill/components and @joyfill/layouts were found to contain an obfuscated Remote Access Trojan (RAT) and credential stealer. The malware executes upon import, not install, enabling it to bypass traditional safeguards. It uses blockchain transactions to resolve command and control (C2) servers, establishes a Socket.IO-based remote access channel, and deploys a Python-based credential stealer targeting developer workstations. The packages were legitimate projects that were hijacked, and the malicious code was injected only into the published tarballs.

AI-extracted · verify before operational use