July 28, 2026: malicious beta releases of legitimate Joyfill npm packages @joyfill/components and @joyfill/layouts leaked, containing a sophisticated credential-stealing remote access trojan (RAT) This article explores npm packages joyfill. . Thus running scripts with `--ignore-scripts` does not mean they will not be executed.

Releases affected include:

  • @joyfill/components@4.0.0-rc24-2773-beta.4
  • @joyfill/components@4.0.0-rc24-2773-beta.5
  • @joyfill/components@4.0.0-rc24-2773-beta.6
  • @joyfill/layouts@0.1.2-2773.beta.0
  • @joyfill/layouts@0.1.2-2773.beta.1
  • @joyfill/layouts@0.1.2-2773.beta.2 The payload is concealed in the compiled JavaScript bundle files, and when imported, it exposes the Node.js require and module functions via global variables. This enables subsequent stages of the malware to load sensitive system functions without revealing suspicious module names. This RAT is capable of carrying out different actions on compromised systems such as profiling, directory listing, uploading and downloading files, stealing clipboard contents, and executing arbitrary JavaScript commands.

We usually see the suspicious activities as separate Node.js processes, npm installations in runtime, calls to blockchain APIs from Node.js applications and plain HTTP Socket.IO comms. It steals from victims passwords, data from extension-wallets, password managers, Git credentials, GitHub CLI tokens, npm tokens, OS keychain secrets and cryptocurrency-wallet keys. See lockfiles and build records with Joyfill prerelease versions 2773: ``` bashgrep -rEn 'joyfill.

*2773' package-lock.json pnpm-lock. yarn.lock.yaml ``` Remove the affected version if installed or imported immediately and rebuild your dependencies from a clean lockfile. Leverage ANY.RUN to avoid the blind spots of SOC investigation that could make a difference between a threat escalation or not and save on response costs and business disruption earlier on.