Malicious beta releases of the legitimate Joyfill npm packages @joyfill/components and @joyfill/layouts were published on July 28, 2026, carrying an advanced credential-stealing remote access trojan (RAT).
The attack is critical because the injected code runs when an application imports the affected package. This means npm install --ignore-scripts does not prevent execution.
Developers, CI/CD environments, and build systems that installed and imported the affected releases should be treated as compromised.
Joyfill npm Credential Stealer
The malicious code was injected only into published package tarballs, not the projects’ visible source repositories.
Researchers found the same heavily obfuscated payload in both Joyfill packages, strongly indicating a shared attacker-controlled implant.
Affected releases include:
@joyfill/components@4.0.0-rc24-2773-beta.4@joyfill/components@4.0.0-rc24-2773-beta.5@joyfill/components@4.0.0-rc24-2773-beta.6@joyfill/layouts@0.1.2-2773.beta.0@joyfill/layouts@0.1.2-2773.beta.1@joyfill/layouts@0.1.2-2773.beta.2
The payload is hidden inside built JavaScript bundle files. When imported, it exposes Node.js require and module functions through global variables, allowing later malware stages to load sensitive system functions without clearly showing suspicious module names.
The malware uses public blockchain services as a command-and-control (C2) lookup system.
It retrieves data from Tron, BNB Smart Chain, and Aptos transactions, decrypts the information in memory, and uses it to identify attacker-controlled infrastructure. This design lets attackers change their C2 server without republishing the malicious package.
The attack then establishes a Socket.IO-based RAT connection. The primary npm campaign reportedly uses 166.88.134.62 as its C2 infrastructure.
The RAT can profile infected systems, list directories, upload and download files, steal clipboard content, and execute arbitrary JavaScript commands.
It also attempts to install missing dependencies such as axios and socket.io-client at runtime. Suspicious behavior may include detached node -e processes, unexpected runtime npm installations, blockchain API calls from Node.js processes, and plain HTTP Socket.IO communications.
Most importantly, the malware includes worm-like persistence capabilities. It can inject a loader into developer applications and tools, including VS Code-related modules, Cursor, Discord, GitHub Desktop, and the globally installed npm CLI.
Modifying npm’s lib/cli.js is particularly dangerous because every future npm command can trigger the malware again.
The final payload stages a Python-based credential stealer, primarily targeting developer workstations rather than CI runners.
It is designed to steal browser passwords, browser extension wallet data, password-manager information, Git credentials, GitHub CLI tokens, npm tokens, OS keychain secrets, and cryptocurrency wallet keys.
Collected data is reportedly staged under %USERPROFILE%\.npm on Windows or /tmp/.npm on Linux and macOS before being encrypted and sent to attacker infrastructure, stepsecurity said.
Security teams should search lockfiles and build records for Joyfill prerelease versions containing 2773:
bashgrep -rEn 'joyfill.*2773' package-lock.json yarn.lock pnpm-lock.yaml
If an affected version was installed or imported, remove it immediately and rebuild dependencies from a clean lockfile. Organizations should pin to known-good releases published before July 28, 2026, such as:
bashnpm install @joyfill/components@4.0.0-rc24 @joyfill/layouts@0.1.1
Developer devices require priority investigation. Inspect npm CLI files and Electron application bundles for injected markers including C250617A, C260512A, and RS260605. Reinstall affected developer tools if tampering is discovered.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
