Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Socket.IO RAT : canal C2 persistant via controller.rightwidth[.]dev (HTTPS), détection VM/sandbox, accès shell interactif via child_process.exec() .
16 distinct techniques documented for this family, organized by ATT&CK tactic.
On July 28, 2026, malicious beta versions of two Joyfill npm packages, @joyfill/components and @joyfill/layouts, were published to the npm registry... The packages are legitimate projects that were hijacked, and the malicious code lives only in the published tarballs.
...registers a command handler with verbs for host info, file upload and download, directory listing, and arbitrary code execution (ss_info, ss_eval, ss_upf, ss_upd, ss_dir, and more).
The payload is not a postinstall script. It is compiled into the package entry bundles, so it executes the moment a project imports the package.
Both versions carry the same heavily obfuscated payload injected into the built distribution bundles... The first stage is a string shuffle decoder... static analysis for literal terms like socket.io or a wallet address finds nothing.
Socket.IO RAT : canal C2 persistant via controller.rightwidth[.]dev (HTTPS), détection VM/sandbox
The payload is not a postinstall script. It is compiled into the package entry bundles, so it executes the moment a project imports the package.
T1057 — Process Discovery (Discovery)
Operators can request host details, steal clipboard content, move files, and run scripts on the victim system.
...registers a command handler with verbs for host info, file upload and download, directory listing... (ss_upf, ss_upd, ss_dir...)
Socket.IO RAT : canal C2 persistant via controller.rightwidth[.]dev (HTTPS), détection VM/sandbox
That worm style behavior means one infected machine can keep reloading the threat and may pass it into new packages.
Operators can request host details, steal clipboard content, move files, and run scripts on the victim system.
The resolved stage configures a Socket.IO client to the C2 and registers a command handler with verbs for host info, file upload and download, directory listing, and arbitrary code execution.
Socket.IO RAT : canal C2 persistant via controller.rightwidth[.]dev (HTTPS)
T1102 — Web Service (Command and Control)
In parallel it spawns a detached node -e child that requests /$/boot from a second host and XOR decrypts the response, so the two stages run independently.
The malware opens a remote control channel and later tries to steal developer secrets from the workstation.
Rather than hardcode a server, the payload reads a transaction from a fixed Tron address, follows it to a Binance Smart Chain transaction... decodes and XOR decrypts the transaction input, and evaluates the result as JavaScript.
24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.