--- title: npm backdoor executes at import time, MCP spec goes... description: Two beta npm packages from @joyfill were backdoored with a RAT that fires at import time — not install time — making the usual --ignore-scripts defense... canonical: https://daily.dev/posts/npm-backdoor-executes-at-import-time-mcp-spec-goes-stateless-pjoy6apxi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: npm backdoor executes at import time, MCP spec goes stateless | daily.dev og:description: Two beta npm packages from @joyfill were backdoored with a RAT that fires at import time — not install time — making the usual --ignore-scripts defense... og:url: https://daily.dev/posts/npm-backdoor-executes-at-import-time-mcp-spec-goes-stateless-pjoy6apxi og:image: https://api.daily.dev/og/posts/PjOY6apXi.png og:image:alt: npm backdoor executes at import time, MCP spec goes stateless og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # npm backdoor executes at import time, MCP spec goes stateless **[Backend Digest](https://daily.dev/sources/backend_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary Two beta npm packages from @joyfill were backdoored with a RAT that fires at import time — not install time — making the usual --ignore-scripts defense useless. The MCP 2026-07-28 spec landed with a major architectural shift to stateless request/response, enabling serverless and edge deployments. Atlassian shared how they scaled StreamHub from 22B to 150B daily events by migrating from Kinesis to Kafka. The Arista VeloCloud CVE-2026-16812 CISA deadline is July 30 — if you haven't patched yet, that's today. ## Content **TLDR:** Two beta npm packages from @joyfill were backdoored with a RAT that fires at import time — not install time — making the usual --ignore-scripts defense useless. The MCP 2026-07-28 spec landed with a major architectural shift to stateless request/response, enabling serverless and edge deployments. Atlassian shared how they scaled StreamHub from 22B to 150B daily events by migrating from Kinesis to Kafka. The Arista VeloCloud CVE-2026-16812 CISA deadline is July 30 — if you haven't patched yet, that's today. --- ## @joyfill npm packages backdoored with import-time RAT, --ignore-scripts won't save you Two beta versions of @joyfill/layouts and @joyfill/components published July 28 contain a heavily obfuscated remote access trojan linked to the DEV#POPPER malware family. The critical detail: the implant executes at import time, not via install lifecycle hooks, so npm install --ignore-scripts does nothing. C2 infrastructure retrieves encrypted payloads via blockchain transactions on Tron, Aptos, and BNB Smart Chain rather than hardcoded IPs. The RAT can execute arbitrary shell commands, exfiltrate files, and persist by injecting into VS Code, Cursor, Discord Desktop, and the global npm CLI. Any machine that imported a 2773 prerelease version of either package should be treated as fully compromised — rotate every credential accessible from that Node.js process. [Read more](https://daily.dev/posts/yWMoROWLT) ## MCP 2026-07-28 spec goes stateless, passes 400M monthly SDK downloads The fifth MCP release drops the stateful bidirectional protocol in favor of a stateless request/response core, which finally makes MCP deployable on serverless and edge infrastructure without persistent connections. The spec also hardens authorization to align with production OAuth 2.0 and OIDC, adding support for enterprise identity providers like Entra and Okta. SDK downloads hit 400M per month, a 4x increase this year, with Claude now listing over 950 MCP servers. New Claude-specific additions include MCP tunnels in research preview for connecting to private network servers without public exposure. [Read more](https://daily.dev/posts/9iF5vL93Z) ## Atlassian scaled StreamHub from 22B to 150B daily events migrating Kinesis to Kafka Kinesis hit its limits on shard costs, retention constraints, and consumer throughput, so Atlassian moved to Apache Kafka via AWS MSK with Tiered Storage on S3 to cut infrastructure costs. Six operational problems surfaced at scale that don't show up in smaller deployments: broker network saturation, S3 request rate storms during retention changes, managed control plane unavailability during AZ failures, and slow scaling operations mid-incident. The fixes — intentional over-provisioning, ingress rate limiting, Kafka client quotas, cluster sharding with failover runbooks — are the kind of thing you only learn by running it at this volume. [Read more](https://daily.dev/posts/MJsIEQ3rP) ## Backdoored @joyfill packages prompt GitHub and npm to ship supply chain mitigations GitHub shipped several supply chain hardening measures that land directly on the attack surface the @joyfill incident exposed: npm's 72-hour read-only mode after sensitive account changes, staged publishing requiring additional 2FA approval, npm v12 disabling install scripts by default, Dependabot's new 3-day cooldown before opening version update PRs, and an Actions network firewall in technical preview. Separately, npm is adding publish-time malware scanning with a typical 5-minute delay, a new contentPolicy field for dual-use packages, and mandatory DISCLOSURE files for packages with security-relevant capabilities. [Read more](https://daily.dev/feed-by-ids?id=LSKGC4rqS&id=hzy6QCZtW) --- ## Also notable - **Arista VeloCloud CVE-2026-16812 CISA remediation deadline is July 30:** The CVSS 10.0 unauthenticated command injection flaw in VeloCloud Orchestrator 5.2.x, 6.1.x, 6.4.x, and 7.0.x is already being exploited in the wild — patches are available now and the federal deadline is today. [Read more](https://daily.dev/posts/2RFHBdThL) - **EKS Provisioned Control Plane now runs HPA sync at up to 40x default Kubernetes concurrency:** Clusters with hundreds or thousands of HPA objects get faster scale-out with no configuration changes required — the enhancement is automatic for all EKS Provisioned Control Plane customers. [Read more](https://daily.dev/posts/EjYwCyYnJ) - **Uber's GOGCTunner reclaimed 70,000 CPU cores across 30 Go services:** The dynamic GC tuning library adjusts GOGC based on cgroup memory limits and live object utilization; Uber also capped individual developer AI spend at $1,500/month after costs grew sixfold since 2024. [Read more](https://daily.dev/posts/VsVGEJJG1) - **24,650 internet-exposed BMCs leaking crackable password hashes via CVE-2013-4786:** Researchers found 36,872 exposed IPMI hosts on UDP port 623, of which 24,650 returned authentication material; around 2,340 used weak passwords matching public dictionaries — keep IPMI off the public internet. [Read more](https://daily.dev/posts/YGoR8JoG4) - **Dependabot malware alerts now cover PyPI via OpenSSF malicious-packages ingestion:** GitHub's Advisory Database now pulls malware advisories from the OpenSSF malicious-packages repository, extending coverage beyond npm to PyPI with no configuration changes required for repos already using malware alerting. [Read more](https://daily.dev/posts/eRZhoaRtx) ## Similar posts on daily.dev - [Hackers backdoor Jscrambler npm package with infostealer malware](https://daily.dev/posts/hackers-backdoor-jscrambler-npm-package-with-infostealer-malware-blf8gd33m) · BleepingComputer · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#mcp](https://daily.dev/tags/mcp), [#npm](https://daily.dev/tags/npm), [#apache-kafka](https://daily.dev/tags/apache-kafka) [View this post on daily.dev](https://daily.dev/posts/npm-backdoor-executes-at-import-time-mcp-spec-goes-stateless-pjoy6apxi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/npm-backdoor-executes-at-import-time-mcp-spec-goes-stateless-pjoy6apxi","headline":"npm backdoor executes at import time, MCP spec goes stateless","text":"Two beta npm packages from @joyfill were backdoored with a RAT that fires at import time — not install time — making the usual --ignore-scripts defense useless. The MCP 2026-07-28 spec landed with a major architectural shift to stateless request/response, enabling serverless and edge deployments. Atlassian shared how they scaled StreamHub from 22B to 150B daily events by migrating from Kinesis to Kafka. The Arista VeloCloud CVE-2026-16812 CISA deadline is July 30 — if you haven't patched yet, that's today.","url":"https://daily.dev/posts/npm-backdoor-executes-at-import-time-mcp-spec-goes-stateless-pjoy6apxi","datePublished":"2026-07-29T04:19:29.459Z","dateModified":"2026-07-29T04:19:50.628Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"npm backdoor executes at import time, MCP spec goes stateless"}]} ```