--- title: Two @joyfill npm beta packages found shipping a remote... description: Two beta npm packages from the @joyfill organization — `@joyfill/layouts@0.1.2-2773.beta.0` and `@joyfill/components@4.0.0-rc24-2773-beta.4` — were found... canonical: https://daily.dev/posts/two-joyfill-npm-beta-packages-found-shipping-a-remote-access-trojan-and-credential-stealer-ywmorowlt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Two @joyfill npm beta packages found shipping a remote access trojan and credential stealer | daily.dev og:description: Two beta npm packages from the @joyfill organization — `@joyfill/layouts@0.1.2-2773.beta.0` and `@joyfill/components@4.0.0-rc24-2773-beta.4` — were found... og:url: https://daily.dev/posts/two-joyfill-npm-beta-packages-found-shipping-a-remote-access-trojan-and-credential-stealer-ywmorowlt og:image: https://api.daily.dev/og/posts/yWMoROWLT.png og:image:alt: Two @joyfill npm beta packages found shipping a remote access trojan and credential stealer og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Two @joyfill npm beta packages found shipping a remote access trojan and credential stealer **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 1 comments ## Summary Two beta npm packages from the @joyfill organization — `@joyfill/layouts@0.1.2-2773.beta.0` and `@joyfill/components@4.0.0-rc24-2773-beta.4` — were found shipping a multi-stage malware implant. Unlike typical supply chain attacks, the payload triggers on import rather than install, bypassing `--ignore-scripts` protections. The malware uses blockchain transactions on Tron, Aptos, and BNB Smart Chain as a C2 lookup mechanism, then downloads a Node.js RAT (DEV#POPPER family) via Socket.IO. Attackers can execute arbitrary code, exfiltrate files, read clipboard contents, and deploy a Python infostealer (OmniStealer) targeting browser credentials, crypto wallets, Git tokens, and OS keychains. Persistence is achieved by injecting into VS Code, Cursor, Discord, GitHub Desktop, and the global npm CLI — the last of which risks spreading to other projects. All versions containing '2773' in the version string are compromised. Affected machines should be treated as fully compromised, with all credentials rotated immediately. ## Content Two beta versions of legitimate npm packages were quietly backdoored and published on July 28, 2026: `@joyfill/layouts@0.1.2-2773.beta.0` and `@joyfill/components@4.0.0-rc24-2773-beta.4`. Both contain a heavily obfuscated remote access trojan that researchers have linked to the DEV#POPPER malware family. ## What makes this one unusual Most supply chain attacks hook into npm's install lifecycle scripts, which means running `npm install --ignore-scripts` stops them cold. This one doesn't. The implant executes at **import time** — the moment your code loads the module — so the usual protection does nothing here. The command-and-control mechanism is also worth noting. Rather than hardcoding a server address (which gets blocked and burned quickly), the malware queries blockchain transactions on Tron, Aptos, and BNB Smart Chain to retrieve an encrypted payload. The final stage is a 77 KB Node.js RAT delivered over a Socket.IO channel. A separate detached process simultaneously fetches a boot payload from a hardcoded IP address. ## What the RAT can do Once running, the trojan can: - Execute arbitrary JavaScript and shell commands - Exfiltrate files and read clipboard contents - Collect host information - Persist by injecting into VS Code, Cursor, Discord Desktop, GitHub Desktop, and the global npm CLI It can also deploy a Python infostealer — assessed as OmniStealer — that goes after browser credentials, crypto wallet extensions, Git tokens, and OS keychains. ## Who's affected Any machine that imported either package with a `2773` prerelease version string. Check your lockfiles for those strings. If you find them, treat the machine as fully compromised — not just the project. ## What to do 1. Remove the compromised versions and pin to pre-compromise releases 2. Rotate every credential that was accessible from the affected Node.js process: API keys, Git tokens, cloud credentials, anything stored in the browser or OS keychain on that machine 3. Audit VS Code extensions, the global npm CLI, and any Electron apps (Discord, GitHub Desktop, Cursor) for signs of injected code The affected versions are all `2773` prereleases of both packages. ## Community discussion Top comments from developers on daily.dev. **@petecapecod** · 0 upvotes > ugh I'm tired boss, no more malware for a little bit. Let's try that and see how it goes lol ## Similar posts on daily.dev - [Researchers Uncover NodeCordRAT Hidden in npm Bitcoin-Themed Packages](https://daily.dev/posts/researchers-uncover-nodecordrat-hidden-in-npm-bitcoin-themed-packages-90ednfct7) · The Hacker News · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#nodejs](https://daily.dev/tags/nodejs), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/two-joyfill-npm-beta-packages-found-shipping-a-remote-access-trojan-and-credential-stealer-ywmorowlt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Two @joyfill npm beta packages found shipping a remote access trojan and credential stealer","url":"https://daily.dev/posts/two-joyfill-npm-beta-packages-found-shipping-a-remote-access-trojan-and-credential-stealer-ywmorowlt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/two-joyfill-npm-beta-packages-found-shipping-a-remote-access-trojan-and-credential-stealer-ywmorowlt"},"datePublished":"2026-07-28T17:33:56.185Z","dateModified":"2026-07-28T18:56:13.999Z","description":"Two beta npm packages from the @joyfill organization — `@joyfill/layouts@0.1.2-2773.beta.0` and `@joyfill/components@4.0.0-rc24-2773-beta.4` — were found...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bffe8bfa3f4f2b377f99fc3cad121efa?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bffe8bfa3f4f2b377f99fc3cad121efa?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/two-joyfill-npm-beta-packages-found-shipping-a-remote-access-trojan-and-credential-stealer-ywmorowlt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,nodejs,malware,npm","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Two @joyfill npm beta packages found shipping a remote access trojan and credential stealer"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/two-joyfill-npm-beta-packages-found-shipping-a-remote-access-trojan-and-credential-stealer-ywmorowlt","comment":[{"@type":"Comment","text":"ugh I’m tired boss, no more malware for a little bit. Let’s try that and see how it goes lol","datePublished":"2026-07-29T12:41:25.178Z","url":"https://daily.dev/posts/yWMoROWLT#c-lQrwgNI5j","author":{"@type":"Person","name":"Peter Cruckshank","url":"https://daily.dev/petecapecod","image":"https://media.daily.dev/image/upload/s--ZJhQyKws--/f_auto/v1721235024/avatars/avatar_A9xh33q0QoxtkGoJRCosp"}}]} ```