Joyfill npm Supply-Chain Attack Deploys RAT and Developer Credential Stealer

A supply-chain compromise targeting the npm ecosystem has introduced a multi-stage remote access trojan (RAT) and credential stealer through hijacked Joyfill packages, highlighting an increasingly sophisticated abuse of trusted developer dependencies.

On July 28, 2026, malicious beta releases of @joyfill/components and @joyfill/layouts were published to the npm registry, embedding heavily obfuscated payloads directly into compiled distribution bundles.

Unlike traditional npm attacks leveraging postinstall scripts, this implant executes at import time, meaning even defensive flags such as npm install –ignore-scripts fail to prevent execution.

The malicious code resides exclusively in published tarballs, with no corresponding source-level changes strong evidence of a registry or publishing pipeline compromise.

StepSecurity independently verified the intrusion via its OSS AI scanning system, runtime detonation using Harden-Runner, and binary diffing of affected builds.

Notably, @joyfill/[email protected] was flagged as Critical with a security score of 0 and a rejected verdict.

Identical obfuscated payloads across both packages further indicate a single threat actor deploying a shared implant.

The initial loader, embedded within dist bundles, executes upon import and exposes Node.js primitives (require and module) via global object manipulation.

It employs multi-layered obfuscation, including seeded string shuffling and dictionary-based decompression, ensuring that the actual payload never appears in plaintext within the package.

This design allows attackers to dynamically rotate C2 endpoints while blending malicious traffic with legitimate Web3 API calls such as api.trongrid.io and bsc-dataseed.binance.org, which are commonly allowlisted in CI/CD environments.

Once resolved, the malware deploys a Socket.IO-based RAT capable of system reconnaissance, file exfiltration, arbitrary code execution, and clipboard harvesting.

It fingerprints infected systems, including developer workstations and CI runners, and establishes persistence by injecting loader stubs into widely used applications such as VS Code (via @vscode/deviceid), Discord, GitHub Desktop, and critically, the global npm CLI.

This latter technique enables worm-like propagation: any subsequent npm operation on an infected machine can reintroduce the payload into newly built packages.

StepSecurity Researchers said that, the attack chain is notably advanced, consisting of a five-stage in-memory execution flow designed to evade static and behavioral detection.

Joyfill npm Supply-Chain Attack

In parallel, the malware stages a Python-based credential stealer targeting high-value assets, including browser-stored credentials, cryptocurrency wallets, GitHub CLI tokens, and OS keychains.

Collected data is encrypted and exfiltrated to attacker-controlled infrastructure.

A key innovation in this campaign is its blockchain-based command-and-control (C2) resolution. Instead of hardcoding infrastructure, the malware retrieves a transaction from a Tron address, pivots to Binance Smart Chain via eth_getTransactionByHash, and decrypts the payload using XOR logic.

Indicators tied to the npm campaign include HTTP-based Socket.IO traffic to 166.88.134.62:443 and campaign identifier A9-0135-3, embedded via a global marker.

Additional infrastructure (198.105.127.210 and 23.27.202.27) supports alternate distribution channels, suggesting a broader malware family beyond this specific supply–chain vector.

Despite the sophistication, runtime detonation under controlled conditions did not produce outbound connections, likely due to rapid takedown of attacker-controlled blockchain pointers following disclosure.

However, payload presence was conclusively confirmed through bundle diffing and code extraction.

All 2773 prerelease versions of the affected packages must be treated as fully compromised. Organizations are advised to immediately remove these versions, pin dependencies to pre-July 28 releases, and rotate all credentials exposed to affected environments.

Given the persistence mechanisms and npm CLI infection vector, remediation should include full workstation reimaging and integrity verification of developer toolchains.

This incident underscores a critical shift in supply-chain attacks toward runtime-triggered implants, decentralized C2 mechanisms, and developer-focused post-exploitation, reinforcing the need for deeper runtime inspection, egress monitoring, and artifact-level integrity validation beyond traditional dependency scanning.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist