Critical Flaw in Joyfill npm Packages Lets Attackers Deploy RAT and Steal Credentials

Key Takeaways

• Malicious beta versions of Joyfill npm packages, @joyfill/components and @joyfill/layouts, were uploaded to the npm registry on July 28, 2026.
• These packages contain a sophisticated remote access trojan (RAT) that activates upon import, not requiring a separate install script.
• The malware establishes a remote control channel, attempts to steal developer credentials and sensitive data, and exhibits worm-like behavior by injecting itself into developer tools like VS Code and the global npm CLI.
• Organizations that incorporated any of the 2773 compromised pre-release builds should consider affected systems fully compromised and undertake extensive remediation, including credential rotation and application reinstallation.

Widespread Supply Chain Attack Targets npm Ecosystem with RAT

A significant supply chain incident has been uncovered, impacting open-source software development teams after malicious code was embedded within legitimate npm libraries. On July 28, 2026, an attacker published compromised beta builds of two popular Joyfill packages, @joyfill/components and @joyfill/layouts, to the npm registry. These libraries are widely utilized in web application development for UI forms and layout management.

Unlike typical malware requiring explicit installation scripts, the threat within these beta builds activates immediately upon import into a project. The embedded malicious payload establishes a remote control channel, giving attackers unauthorized access, and subsequently attempts to exfiltrate sensitive developer credentials and system data.

Researchers from StepSecurity identified the campaign after their automated scanning systems flagged a build of the @joyfill/layouts package as critical. StepSecurity said in a report that the identical obfuscated implant was present in both affected packages. Crucially, the malicious code was found exclusively within the published tarball packages, not in the clean source code repositories, indicating a targeted injection during the build or publishing process.

The firm validated its findings through sandbox execution and by meticulously comparing the compromised builds against known safe versions. The ramifications of this attack extend beyond individual projects; once active, the malware can persist by injecting itself into frequently used developer tools, including code editors and the global npm command-line interface.

This self-propagating behavior means an infected machine can continuously re-introduce the threat and potentially spread it to new development packages. Any team that incorporated one of the 2773 identified pre-release versions should consider those development environments compromised until a thorough cleanup and remediation process is completed.

This incident aligns with a growing trend of attackers exploiting trusted open-source projects rather than creating entirely new malicious ones. Previous npm package compromises have demonstrated how rapidly stolen tokens and keys can grant attackers further access to cloud platforms and code hosting accounts.

Hijacked Joyfill npm Packages: The Attack Chain

The attack unfolds in a five-stage process, beginning the moment an application imports the compromised package. Initially, a concealed loader sets a campaign tag and exposes Node.js features under abbreviated global names. It then queries public blockchain data to dynamically ascertain the live command-and-control (C2) server’s address, circumventing the need for hardcoded C2 infrastructure within the package.

Following this lookup, the malware executes additional code directly in memory and establishes a connection via Socket.IO. This enables the threat actors to perform various malicious actions, including requesting host details, stealing clipboard content, manipulating files, and executing arbitrary scripts on the victim’s system.

The agent further solidifies its persistence by injecting copies of itself into modules for applications such as VS Code, Cursor, Discord, GitHub Desktop, and the npm CLI. This ensures the threat reactivates even after system restarts. The ability to patch the global npm CLI is particularly dangerous, as every subsequent npm command could re-trigger the loader, creating a persistent infection vector.

This self-spreading mechanism mirrors previous supply chain worm activities where a single point of compromise was used to expand access across everyday developer tools. Campaign tags, such as “A9-0135-3” for the npm path, direct victims to specific C2 hosts designated for socket communication and file uploads. A subsequent Python helper script is then deployed to harvest browser data, cryptocurrency wallet extensions, password manager vaults, Git tokens, and keychains for exfiltration.

Credential Theft and Recovery Steps

The ultimate objective of this attack is the developer’s workstation, providing a more persistent and valuable target than a temporary build runner. Stolen browser secrets, source control tokens, and npm credentials can grant attackers access to private repositories, cloud accounts, and critical package publishing rights, enabling further supply chain attacks.

Defenders should monitor for anomalous plain HTTP socket traffic, unusual child Node.js processes, or unexpected modifications within editor and npm configuration files, as these indicators may bypass standard registry integrity checks.

What You Should Do

• Identify and Remove Malicious Packages: If any of the 2773 beta versions of the affected Joyfill packages (e.g., @joyfill/[email protected], @joyfill/[email protected]) are present in your project’s lockfile, immediately remove them. Pin your dependencies to known good releases published before July 28, 2026.
• Clean and Reinstall: Delete your node_modules directory and reinstall dependencies from a clean, verified lockfile to ensure the injected bundle is eradicated.
• Inspect and Reinstall Developer Tools: On any machine that imported the malicious code, meticulously inspect developer tool files (e.g., VS Code, Cursor, Discord, GitHub Desktop, npm CLI) for injection markers (e.g., C250617A). If markers are found, fully reinstall those applications from trusted sources.
• Rotate All Credentials: Rotate every secret that was present on affected systems, including browser-stored passwords, Git tokens, npm tokens, and cryptocurrency wallet keys.
• Review Network Logs: Examine outbound network logs for connections to the identified command-and-control hosts (e.g., 166.88.134.62, 23.27.13.43) and blockchain C2 resolver endpoints (e.g., api.trongrid.io).
• Enhance Monitoring: Implement continuous lockfile integrity checks and monitor for unusual Node.js process activity and suspicious outbound network egress as part of your dependency review process.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.