Loading malware…
9 distinct techniques documented for this family, organized by ATT&CK tactic.
On July 28, 2026, malicious beta versions of two Joyfill npm packages, @joyfill/components and @joyfill/layouts, were published to the npm registry... The packages are legitimate projects that were hijacked, and the malicious code lives only in the published tarballs.
The payload is not a postinstall script. It is compiled into the package entry bundles, so it executes the moment a project imports the package.
Both versions carry the same heavily obfuscated payload injected into the built distribution bundles... The first stage is a string shuffle decoder... static analysis for literal terms like socket.io or a wallet address finds nothing.
The payload is not a postinstall script. It is compiled into the package entry bundles, so it executes the moment a project imports the package.
A staged Python helper later gathers browser data, wallet extensions, password managers, Git tokens, and keychains for upload.
A staged Python helper later gathers browser data, wallet extensions, password managers, Git tokens, and keychains for upload.
Stolen browser secrets, source control tokens, and npm credentials can open private repositories, cloud accounts, and package publishing rights.
...packs them into an encrypted archive, and uploads them to the C2.
A staged Python helper later gathers browser data, wallet extensions, password managers, Git tokens, and keychains for upload.
...packs them into an encrypted archive, and uploads them to the C2.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.