Compromised joyfill npm packages run a remote access trojan when imported

Attackers published malicious versions of the @joyfill/components and @joyfill/layouts npm packages that run a remote access trojan as soon as the package is imported, not merely installed. Because the payload executes at import time, defenses that block install scripts, such as installing with scripts disabled, do not stop it. The malicious code sat only in the published tarballs with no matching source change, pointing to a registry or publishing pipeline compromise. Once loaded, it profiles the host, opens a remote-control channel, and can run shell commands, upload files, read the clipboard, and tamper with developer tools, using blockchain networks to resolve its next payload for resilience.

Check

Check whether any project, CI runner, or build imported the malicious @joyfill/components or @joyfill/layouts versions, focusing on import-time execution rather than only install scripts.

Affected

Developers and CI pipelines that imported the compromised joyfill packages; the trojan runs in any process that loads them, giving attackers remote control and access to developer credentials and tools.

Fix

Remove the malicious versions, pin known-good releases, rebuild from clean state, rotate secrets reachable from affected machines, and add runtime and egress monitoring, since install-script controls do not catch import-time payloads.