Joyfill npm Supply

Gbhackers •Mayura Kathir • July 29, 2026

A supply-chain compromise targeting the npm ecosystem has introduced a multi-stage remote access trojan (RAT) and credential stealer through hijacked Joyfill packages, highlighting an increasingly sophisticated abuse of trusted developer dependencies. On July 28, 2026, malicious beta releases of @joyfill/components and @joyfill/layouts were published to the npm registry, embedding heavily obfuscated payloads directly into compiled […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious Joyfill npm Packages Distribute DEV#POPPER RAT and Credential Stealer On July 28, 2026, two beta releases of Joyfill npm packages, @joyfill/layouts and @joyfill/components, were found to deliver the DEV#POPPER remote access trojan (RAT) and a credential stealer. The malware executes upon importing the compromised packages, bypassing traditional npm security measures. The affected packages collectively receive around 16,000 weekly downloads, with significant implications for developers using these dependencies. The malware employs a blockchain-based delivery method, allowing attackers to update payloads without new npm releases. It can execute arbitrary code, collect host information, and maintain persistence by modifying developer files. Security researchers have linked the malicious code to the PolinRider loader family and noted similarities to a previous incident involving DEV#POPPER. Developers are advised to review their dependencies and monitor for unusual activity. 5 sources 69

Extracted Entities

Joyfill npm Supply

The full story

Extracted Entities

Attack Types (2)

Companies (1)

MITRE ATT&CK (2)

Tools (1)