Malicious npm Packages Target Developer Workstations in Supply Chain Attack
On July 28, 2026, attackers compromised two widely used open-source npm packages @joyfill/components and @joyfill/layouts by publishing malicious beta versions to the npm registry. The affected packages, used for forms and layout development in web applications, contained hidden malware that executed upon import, bypassing traditional install scripts.
Security firm StepSecurity uncovered the campaign after automated scans flagged a critical build of the layouts package. Analysis revealed that the malware, embedded directly in the package tarballs (not the source code), established a remote control channel to steal developer secrets, including browser data, Git tokens, npm credentials, and wallet keys. The attack leveraged blockchain-based command-and-control (C2) resolution, dynamically fetching server addresses to evade detection.
The malware exhibited worm-like behavior, injecting itself into popular developer tools such as VS Code, Cursor, Discord, GitHub Desktop, and the npm CLI. This persistence mechanism allowed the threat to survive restarts, with every subsequent npm command potentially reloading the malicious payload. Over 2,773 beta releases were published within hours, all tied to the same campaign tag (A9-0135-3).
The attack chain involved five stages:
- Initial execution upon package import, setting a campaign tag and exposing Node.js features.
- C2 resolution via blockchain endpoints (e.g., api.trongrid.io, fullnode.mainnet.aptoslabs.com) to locate active servers.
- Socket.IO connection for remote control, enabling file theft, script execution, and clipboard monitoring.
- Self-propagation into developer tools, ensuring persistence.
- Credential harvesting via a Python-based stealer targeting browsers, password managers, and keychains.
Indicators of compromise (IoCs) include the malicious package versions (e.g., @joyfill/components@4.0.0-rc24-2773-beta.4), C2 IP addresses (166.88.134.62, 23.27.13.43), and injection markers in developer tool files (C250617A, RS260605). Organizations that imported these versions should remove the packages, reinstall from clean lockfiles, and rotate all exposed credentials.
The incident reflects a broader trend of open-source supply chain attacks, where legitimate projects are hijacked to distribute malware at scale. Similar campaigns have exploited stolen tokens to access cloud platforms and code repositories, underscoring the risks of import-time execution in dependency management.
Source: https://cybersecuritynews.com/hijacked-joyfill-npm-packages-worm-like-rat/
Joyfill TPRM report: https://www.rankiteo.com/company/joyfill
"id": "joy1785342538",
"linkid": "joyfill",
"type": "Cyber Attack",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Organizations using '
'@joyfill/components or '
'@joyfill/layouts npm packages',
'industry': 'Software Development',
'name': 'Joyfill',
'type': 'Open-source software provider'}],
'attack_vector': 'Malicious npm package publication',
'customer_advisories': 'Organizations using affected npm packages should '
'remove them, reinstall from clean sources, and rotate '
'exposed credentials.',
'data_breach': {'data_exfiltration': 'Yes',
'personally_identifiable_information': 'Yes (browser data, '
'credentials)',
'sensitivity_of_data': 'High (credentials, PII, cryptographic '
'keys)',
'type_of_data_compromised': ['Browser data',
'Git tokens',
'npm credentials',
'Wallet keys']},
'date_detected': '2026-07-28',
'date_publicly_disclosed': '2026-07-28',
'description': 'Attackers compromised two widely used open-source npm '
'packages @joyfill/components and @joyfill/layouts by '
'publishing malicious beta versions to the npm registry. The '
'malware, embedded in the package tarballs, established a '
'remote control channel to steal developer secrets, including '
'browser data, Git tokens, npm credentials, and wallet keys. '
'The attack leveraged blockchain-based command-and-control '
'(C2) resolution and exhibited worm-like behavior, injecting '
'itself into popular developer tools like VS Code, Cursor, '
'Discord, GitHub Desktop, and npm CLI.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to '
'affected organizations',
'data_compromised': 'Developer secrets (browser data, Git tokens, '
'npm credentials, wallet keys)',
'identity_theft_risk': 'High (exposed credentials and PII)',
'operational_impact': 'Potential unauthorized access to code '
'repositories and cloud platforms',
'systems_affected': 'Developer workstations, npm CLI, VS Code, '
'Cursor, Discord, GitHub Desktop'},
'initial_access_broker': {'backdoors_established': 'Worm-like injection into '
'developer tools',
'entry_point': 'Malicious npm package publication',
'high_value_targets': 'Developer workstations, code '
'repositories, cloud '
'platforms'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Open-source supply chain attacks pose significant risks, '
'particularly through import-time execution in '
'dependencies. Organizations must monitor for malicious '
'package versions and enforce credential rotation after '
'exposure.',
'motivation': 'Credential harvesting, data exfiltration',
'post_incident_analysis': {'corrective_actions': ['Enhance npm package '
'publication security '
'(e.g., multi-factor '
'authentication, package '
'signing)',
'Implement automated '
'scanning for malicious '
'dependencies',
'Educate developers on '
'supply chain attack risks'],
'root_causes': ['Lack of npm package publication '
'security controls',
'Import-time execution '
'vulnerabilities in npm packages',
'Insufficient monitoring of '
'open-source dependencies']},
'recommendations': ['Remove malicious npm packages and reinstall from clean '
'lockfiles',
'Rotate all exposed credentials (Git tokens, npm '
'credentials, wallet keys)',
'Scan developer workstations for injected malware in '
'tools like VS Code and npm CLI',
'Monitor for blockchain-based C2 resolution in network '
'traffic',
'Implement stricter dependency management policies'],
'references': [{'source': 'StepSecurity'}],
'response': {'containment_measures': 'Removal of malicious packages, '
'reinstallation from clean lockfiles',
'remediation_measures': 'Rotation of exposed credentials, '
'removal of injected malware from '
'developer tools',
'third_party_assistance': 'StepSecurity'},
'title': 'Malicious npm Packages Target Developer Workstations in Supply '
'Chain Attack',
'type': 'Supply Chain Attack',
'vulnerability_exploited': 'Import-time execution in npm packages'}