Malicious npm Packages Target Developer Workstations in Supply Chain Attack On July 28, 2026, attackers compromised two widely used open-source npm packages @joyfill/components and @joyfill/layouts by publishing malicious beta versions to the npm registry. The affected packages, used for forms and layout development in web applications, contained hidden malware that executed upon import, bypassing traditional install scripts. Security firm StepSecurity uncovered the campaign after automated scans flagged a critical build of the layouts package. Analysis revealed that the malware, embedded directly in the package tarballs (not the source code), established a remote control channel to steal developer secrets, including browser data, Git tokens, npm credentials, and wallet keys. The attack leveraged blockchain-based command-and-control (C2) resolution, dynamically fetching server addresses to evade detection. The malware exhibited worm-like behavior, injecting itself into popular developer tools such as VS Code, Cursor, Discord, GitHub Desktop, and the npm CLI. This persistence mechanism allowed the threat to survive restarts, with every subsequent npm command potentially reloading the malicious payload. Over 2,773 beta releases were published within hours, all tied to the same campaign tag (A9-0135-3). The attack chain involved five stages: 1. Initial execution upon package import, setting a campaign tag and exposing Node.js features. 2. C2 resolution via blockchain endpoints (e.g., api.trongrid.io, fullnode.mainnet.aptoslabs.com) to locate active servers. 3. Socket.IO connection for remote control, enabling file theft, script execution, and clipboard monitoring. 4. Self-propagation into developer tools, ensuring persistence. 5. Credential harvesting via a Python-based stealer targeting browsers, password managers, and keychains. Indicators of compromise (IoCs) include the malicious package versions (e.g., @joyfill/[email protected]), C2 IP addresses (166.88.134.62, 23.27.13.43), and injection markers in developer tool files (C250617A, RS260605). Organizations that imported these versions should remove the packages, reinstall from clean lockfiles, and rotate all exposed credentials. The incident reflects a broader trend of open-source supply chain attacks, where legitimate projects are hijacked to distribute malware at scale. Similar campaigns have exploited stolen tokens to access cloud platforms and code repositories, underscoring the risks of import-time execution in dependency management.