Loading story…
Two prerelease packages in the legitimate @joyfill npm namespace — @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4 — were published with malicious code embedded in their distribution bundles, causing the payload to run when the package was imported rather than during installation. Researchers said the implant exposed Node.js require and module globally, resolved command-and-control infrastructure through transactions on Tron, Aptos, and BNB Smart Chain, and then fetched additional payloads including a Node.js remote-access trojan that opened a Socket.IO channel and a downloader contacting 23[.]27[.]13[.]43/$/boot with the header Sec-V: A9-0135-3.
Analysis linked the recovered malware to the PolinRider loader family and DEV#POPPER, while downstream activity also showed a Python credential stealer assessed as a likely OmniStealer variant targeting developer workstations. The compromise affects development environments, CI runners, test tooling, server-side rendering, and build systems that import the packages, and protections such as npm install --ignore-scripts do not prevent execution because the malicious logic was bundled before publication. Investigators said earlier versions, including @joyfill/layouts@0.1.1 and @joyfill/components@4.0.0-rc24, appeared clean, and advised organizations to treat any environment using the 2773 prerelease versions as compromised, remove them, rebuild from trusted lockfiles, inspect for persistence, and rotate exposed credentials.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
Socket and StepSecurity published analyses describing the compromised Joyfill prerelease packages, including blockchain-backed command-and-control resolution, a Node.js remote-access trojan, and a staged Python credential stealer. Both reports said prior versions were clean and advised treating environments that installed the affected prerelease versions as compromised.
Malicious beta releases of @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4 were published to npm after the projects were hijacked. The published bundles contained import-time malware that executed when the packages were loaded rather than during installation.
SafeDep reported that the two malicious Joyfill prerelease packages were removed from npm within hours and replaced by clean versions. The report noted that cached copies of the malicious packages could still remain accessible through third-party registry mirrors.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 42 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
10 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcebsky.app
Open sourcebsky.app
Open sourcestepsecurity.io
Open sourcesocket.dev
Open sourcesafedep.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified a malicious npm supply-chain campaign that impersonated Rollup polyfill tooling to compromise developer workstations and CI/build systems. The primary packages, **`rollup-packages-polyfill-core`** and **`rollup-runtime-polyfill-core`**, mimicked legitimate Rollup-related projects and used staged dependencies including **`swift-parse-stream`**, **`quirky-token`**, **`react-icon-svgs`**, and **`rollup-plugin-polyfill-connect`** to trigger a multi-stage infection chain. The malware fetched obfuscated code from JSONKeeper, decrypted additional payloads retrieved from **`216.126.236.244`**, and executed them locally while using evasive checks to avoid some analysis and cloud development environments. The final payloads gave attackers remote access and enabled theft of browser data, crypto-wallet information, files, clipboard contents, and other developer secrets such as source code, tokens, SSH keys, and cloud credentials. JFrog said the layered package structure, lookalike naming, and tradecraft resemble earlier Lazarus-linked npm operations, while additional reporting tied the activity to a broader North Korea-linked supply-chain effort referred to as **PolinRider**. Some malicious packages were replaced with security-holding versions, but others remained available at the time of reporting, prompting guidance to remove the packages, treat affected hosts as compromised, rotate credentials, and block related outbound traffic.
Jul 12, 2026
Researchers reported a broad software supply chain campaign targeting developers and cryptocurrency users through hijacked packages, browser extensions, and compromised maintainer accounts across ecosystems including **npm**, **Go**, **Chrome**, and **Packagist**. Socket linked the activity to North Korean actors associated with the **Contagious Interview** operation and identified 108 malicious packages and extensions spanning 162 release artifacts, while JFrog separately analyzed hijacked npm packages `html-to-gutenberg` `4.2.11` and `fetch-page-assets` `1.2.9` that were uploaded with malicious code. The activity appears to rely on account hijacking rather than compromise of GitHub itself, and some attacker infrastructure reportedly remains active even after certain packages were removed. The malware chain used unusual delivery and evasion techniques aimed at developer workstations, including a **VS Code folder-open task** instead of standard npm lifecycle scripts, JavaScript hidden in a fake font file, and encrypted payload retrieval from blockchain transaction data on **TRON**, **Aptos**, and **BNB Smart Chain**. Researchers said the campaign deployed components including **BeaverTail**, **DEV#POPPER RAT**, **OmniStealer**, a `socket.io` backdoor, and a Python infostealer to steal browser credentials, password-manager contents, cryptocurrency wallet data, developer secrets, and operating system credential-store material across **Windows**, **macOS**, and **Linux**. Security firms warned that affected developer systems and credentials should be treated as fully compromised.
Aug 3, 2026
The npm package **jscrambler** was compromised through malicious version `8.14.0`, which added an undocumented `preinstall` hook and install-time files that executed hidden native binaries on **Windows, macOS, and Linux** during `npm install`, before application code ran. Researchers said the release appeared to be published directly to npm from a legitimate maintainer account without matching source repository commits or tags, pointing to a likely compromise of the maintainer account or build pipeline. Socket reported detecting the release within minutes of publication and alerted the maintainers, while a subsequent `8.15.0` release appeared clean. Further analysis linked the package to a **Rust-based infostealer** aimed at developer workstations and CI/build environments, creating exposure for source code, environment variables, build credentials, deployment tokens, and other secrets. Reported targets included cloud credentials, browser data, messaging sessions, cryptocurrency wallets, Bitwarden vault contents, and configuration files for AI coding tools such as **Claude Desktop, Cursor, Windsurf, VS Code, and Zed**. Researchers also observed anti-debugging on Windows and macOS, Linux `eBPF` capability, persistence through Windows scheduled tasks and macOS LaunchAgents, and encrypted command-and-control details; because `8.14.0` remained available on npm, pinned installs on older npm clients that still run install scripts could continue to trigger the payload.
Jul 18, 2026