In brief: The packages @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4 contain a JavaScript implant that decrypts and executes malicious code on import.
Two beta versions of npm packages in the @joyfill namespace have been infected with a Remote Access Trojan (RAT) from the DEV#POPPER family. The malware is executed upon import in Node.js.
The affected npm packages are @joyfill/layouts version 0.1.2-2773.beta.0 and @joyfill/components version 4.0.0-rc24-2773-beta.4. Both contain a JavaScript implant that activates at import time and decrypts and executes encrypted code.
The malware code is associated with the DEV#POPPER family, which functions as a Remote Access Trojan. This means that upon successful installation, an attacker gains direct remote access capabilities to the affected system. The infection mechanism exploits the npm installation process — the malware is activated as soon as the packages are imported into Node.js projects, before the actual application loads.
For CTOs and infrastructure teams, this represents a critical supply-chain risk. Beta versions of packages are often assessed with less stringency, which attackers can exploit. It is recommended to immediately check and clean the dependency tree of development and production environments for these specific versions. Additionally, systems on which these packages were installed should be analysed for indicators of RAT activity.
Source: thehackernews.com · Published 29 July 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.7.3.