Joyfill npm Packages Compromised, Deploying Worm-Like RAT and Stealing Developer Credentials
Attackers injected a worm-like remote access trojan (RAT) into beta builds of two Joyfill npm packages, targeting developer credentials and spreading through development tools.
Software development teams are facing a new supply chain threat after attackers successfully compromised two popular Joyfill npm packages, @joyfill/components and @joyfill/layouts. Malicious beta builds containing a sophisticated remote access trojan (RAT) were injected into the npm registry on July 28, 2026. These packages, commonly used for form and layout functionalities in web applications, were altered in their beta releases, allowing the malware to execute upon import without relying on traditional install scripts.
Security researchers at StepSecurity identified the campaign after automated scans flagged a malicious build of the @joyfill/layouts package. Their analysis revealed that the same obfuscated implant was present in both compromised packages, but only within the published tarballs, not in the original source code. This indicates a targeted injection into the build or publishing process. The malware is designed to establish a command and control (C2) channel and subsequently exfiltrate sensitive developer secrets from workstations.
The impact of this attack extends beyond individual projects. The RAT possesses worm-like capabilities, enabling it to infect developer tools such as code editors (VS Code, Cursor), the global npm command-line interface (CLI), and other common applications like Discord and GitHub Desktop. By embedding itself within these frequently used tools, the malware ensures persistence and can reinfect systems or spread to new packages and projects.
The attack chain involves five distinct stages. Upon importing the compromised package, a hidden loader executes, setting a campaign tag and preparing Node.js features. Crucially, the malware retrieves its C2 server address by querying public blockchain data from networks like Tron and Binance Smart Chain, rather than hardcoding it. This technique makes the C2 infrastructure more resilient and harder to detect. Once the address is obtained, the malware evaluates further code in memory and establishes a Socket.IO connection.
With the C2 channel active, attackers can issue commands to the infected system, including retrieving host details, exfiltrating clipboard content, transferring files, and executing arbitrary scripts. A staged Python helper component is deployed to gather sensitive data such as browser credentials, cryptocurrency wallet extensions, password manager data, Git tokens, and system keychains for exfiltration. The primary targets are developer workstations, as stolen credentials can grant access to private repositories, cloud environments, and package publishing rights.
Defensive measures against this threat require vigilance beyond standard registry checks. Indicators of compromise include unusual child Node.js processes, unexpected modifications within code editor files or the npm CLI, and suspicious outbound network traffic. Organizations are advised to immediately remove any compromised beta versions (specifically those tagged with '2773') from their lockfiles and reinstall dependencies from known good releases. For infected machines, a thorough inspection of developer tool files for injection markers is recommended, followed by rotating all sensitive credentials, including browser passwords, Git tokens, and npm tokens.
This incident is part of a growing trend of supply chain attacks targeting open-source ecosystems, where attackers leverage trusted projects to distribute malware. The use of blockchain for C2 communication represents an evolving tactic to evade traditional security monitoring. The worm-like propagation mechanism, particularly its ability to reinfect the npm CLI, poses a significant risk to the integrity of the development toolchain and the security of software supply chains.