Compromised @joyfill npm Packages Spread RAT via Blockchain C2

Step by step
How the attack unfolded
Click a phase for details – or let the animation play through.
PHASE 1/6 · Initial Access via Supply Chain

Attackers pushed malicious beta versions of two legitimate npm packages into the registry.

T1195.002 – Supply Chain Compromise: Compromise Software Supply Chain
  • Affected: @joyfill/layouts (0.1.2-2773.beta.0-.2) and @joyfill/components (4.0.0-rc24-2773-beta.4-.6)
  • First published on 2026-07-28 at 10:54 UTC and 11:03 UTC respectively
  • Packages regularly downloaded approx. 16,000 times per week
  • Attributed to North Korean actor PolinRider (Contagious Interview)
PHASE 2/6 · Execution on Import

Malicious code triggers on mere package import, without any postinstall script.

T1059.007 – Command and Scripting Interpreter: JavaScript
  • Executes on require()/import – e.g. unit test, bundler run, dev server or production deploy
  • Malicious code is compiled into the package entry bundles
  • Stage 1: obfuscated loader to fetch the actual payload
  • No user interaction required after installation
PHASE 3/6 · Evasion via Blockchain Queries

The malware hides its control infrastructure behind legitimate blockchain traffic (dead drop).

T1027 – Obfuscated Files or Information T1102 – Web Service
  • Stage 2: queries the Tron and Aptos networks as a dead drop
  • Reference to BNB Smart Chain, payload decrypted via XOR
  • HTTP C2 beacon deferred to stage 2, hindering network monitoring
  • API calls include api.trongrid.io and bsc-dataseed.binance.org
PHASE 4/6 · C2 Connection & Remote Access (RAT)

A remote-access trojan establishes a persistent connection and embeds itself in developer tools.

T1071.001 – Application Layer Protocol: Web Protocols T1105 – Ingress Tool Transfer
  • Stage 3: campaign marker A9-0135-3 selects C2 server, e.g. IP 166.88.134.62
  • Stage 4: DEV RAT establishes persistent connection via Socket.IO
  • Infects the global npm CLI (npm/lib/cli.js) – worm-like spread
  • Persistence also in VS Code and Discord (marker /*C250617A*/)
PHASE 5/6 · Data Theft (OmniStealer)

A Python-based infostealer harvests developer credentials, browser data and crypto wallets.

T1555 – Credentials from Password Stores T1005 – Data from Local System
  • Stage 5: OmniStealer collects Git credentials, API keys and cloud tokens
  • Harvests browser data, clipboard contents and crypto wallets
  • Staging directories: %USERPROFILE%\.npm or /tmp/.npm
  • System data collected by the RAT
PHASE 6/6 · Impact & Escalation

Stolen credentials allow the compromise to spread across the entire cloud infrastructure.

T1078 – Valid Accounts T1567 – Exfiltration Over Web Service
  • Full compromise of the developer machine and build environment
  • Possible spread to cloud infrastructure via stolen tokens
  • Likely exfiltration of personal data (GDPR Art. 33/34)
  • PolinRider campaign spans at least 108 malicious packages (npm, Packagist, Go, Chrome)
Short & clear answers
Frequently asked questions about this incident
Am I affected by the compromised Joyfill npm packages?
You are affected if your developers or build systems pulled one of the malicious versions on July 28, 2026: @joyfill/layouts@0.1.2-2773.beta.0/.1/.2 or @joyfill/components@4.0.0-rc24-2773-beta.4/.5/.6. Check your lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) for the version patterns 0.1.2-2773.beta.* and 4.0.0-rc24-2773-beta.*. The packages may also be present as an indirect dependency of another package.
What exactly do I need to do now if I'm affected?
Completely remove the malicious versions from all caches, mirrors, build images, and lockfiles, and pin to the clean versions @joyfill/layouts@0.1.1 and @joyfill/components@4.0.0-rc24. Immediately rotate all passwords, Git credentials, API keys, cloud tokens, and crypto wallets belonging to affected developers. Isolate affected machines from the network and have them examined forensically; rebuilding from scratch is strongly recommended.
Does just installing the package trigger the malware?
No, it's even worse: the malicious code does not require a postinstall script but runs simply when the package is imported — for example via require() or import. This means a single unit test, a bundler run, starting the dev server, or a production deployment is enough to trigger the malware.
What data was stolen and is this a GDPR incident?
The malware downloads a Python-based infostealer (OmniStealer) that specifically harvests developer credentials, browser data, and crypto wallets. Since access to cloud services and databases containing personal data is very likely also compromised, Article 33 GDPR requires notifying the supervisory authority within 72 hours. If there is a high risk, affected individuals must also be informed under Article 34 GDPR.
The packages are no longer in the registry — does that mean I'm safe?
Not necessarily. The malicious versions were removed from the npm registry around 21:00 UTC on July 28, 2026, but may still exist in caches, mirrors, and previously built build images. Check your local lockfiles and build environments, and scan CI/CD logs for connections to IP addresses like 166.88.134.62 or API calls to api.trongrid.io and bsc-dataseed.binance.org.
More security news
You might also be interested in
Critical Elementor Pro Flaw: Attackers Can Fully Take Over WordPress Sites
A file upload bug in Elementor Pro up to 4.2.1 allows RCE without login. Version 4.2.2 fixes the flaw – update now!
Pods Plugin: Critical Flaw Enables Admin Takeover, No Login
A critical flaw in the WordPress plugin Pods lets attackers overwrite admin passwords without login. Over 100,000 sites are affected.
miniOrange SAML SSO: Critical Bypass Turns Attackers Into Admins
Two critical auth bypasses in the miniOrange SAML SSO plugin allow forged SAML assertions—up to full WordPress admin access.