Malicious beta versions of two legitimate npm packages, @joyfill/components and @joyfill/layouts, were published on July 28, 2026, containing a heavily obfuscated remote access trojan and credential stealer. The payload executes on import (not install), bypassing --ignore-scripts protections. It uses multi-layer string obfuscation, resolves its command-and-control server via blockchain transactions (Tron/BSC), opens a Socket.IO RAT channel, and deploys a Python infostealer targeting browser credentials, wallet extensions, Git tokens, and OS keychains. The malware also persists by injecting into VS Code, Cursor, Discord, GitHub Desktop, and the global npm CLI. Affected versions are all 2773 prereleases of both packages. Developers should remove compromised versions, rotate all credentials on affected machines, and check lockfiles for the 2773 prerelease strings.
