Poisoned Pipeline / Incidents / AS66
@joyfill/components and @joyfill/layouts obfuscated RAT
On 28 July 2026 malicious 2773-beta versions of @joyfill/components and
@joyfill/layouts shipped an obfuscated loader in the published dist
bundles only — not in GitHub source. The code runs on import, so
npm install --ignore-scripts does not stop it. It resolves C2 via Tron /
Aptos / BNB Smart Chain transactions, opens a Socket.IO RAT, and stages
a Python credential stealer. StepSecurity detonated the versions under
Harden-Runner.
Mapped techniques
- T0121 Compromised legitimate artifact
- T0159 Malicious artifact execution
- T0172 Runtime backdoor
- T0184 Harvesting sensitive information from files
- T0169 Push implants across repositories
supply-chain hijacked official npm packages
Official Joyfill packages; payload only in published tarballs.
Loader runs on import, not postinstall.
Socket.IO RAT plus Python stealer after blockchain C2 resolve.
Staged credential theft from developer workstations.
Worm-like self-propagation in later stages.