On July 28, 2026, malicious beta versions of the Joyfill npm packages, @joyfill/components and @joyfill/layouts, were discovered on the npm registry. These packages, commonly used for form and layout functionalities in web applications, were compromised to include a remote access trojan (RAT) capable of self-propagation and credential theft.
Unlike traditional malware that relies on installation scripts, this attack embedded malicious code directly within the package bundles. Consequently, developers who imported these compromised beta versions inadvertently activated the malware, which established a remote control channel and attempted to exfiltrate sensitive developer credentials from the infected systems.
Security firm StepSecurity identified the breach after their automated scans flagged a critical issue in one of the @joyfill/layouts beta releases. Their analysis revealed that the obfuscated malicious code was present solely in the published tarballs and not in the original source code, indicating a targeted supply chain attack.
The malware’s propagation mechanism is particularly concerning. Once executed, it infiltrates commonly used developer tools such as Visual Studio Code, Cursor, Discord, GitHub Desktop, and the npm command-line interface. This worm-like behavior ensures the malware’s persistence across system reboots and its potential spread to other projects and systems.
The attack unfolds in a multi-stage process:
- A concealed loader initializes the attack by setting a campaign identifier and exposing Node.js features under abbreviated global names.
- The loader retrieves data from public blockchain sources to determine the current command-and-control server address, avoiding hardcoded URLs.
- Subsequent code is executed in memory, establishing a connection via Socket.IO.
- The malware then performs various malicious activities, including collecting host information, capturing clipboard data, manipulating files, and executing arbitrary scripts.
- To ensure persistence, the malware injects itself into various developer tools, enabling it to reload upon system restarts.
Developers who have integrated any of the 2773 beta releases of these Joyfill packages should consider their systems compromised. Immediate actions include:
- Removing the affected package versions and reverting to known safe releases published before July 28, 2026.
- Deleting the
node_modulesdirectory and reinstalling dependencies from a clean lockfile to eliminate the malicious code. - Inspecting developer tool configurations for signs of injection and reinstalling affected applications as necessary.
This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. Developers and organizations must exercise heightened vigilance, regularly audit their dependencies, and implement robust security practices to mitigate such risks.
