Joyfill npm Packages Compromised with Remote Access Trojan

Two popular packages published under the 'joyfill' scope on the npm registry have been compromised. The attacker hijacked publishing credentials to inject a Remote Access Trojan (RAT) into minor versions of the library, targeting developer workstations.

The RAT attempts to steal environment variables, SSH keys, and browser credentials from developers running install commands. Developers verifying npm dependency graphs can scan code blocks using the [Code Formatter](/tools/code-formatter/).

Injecting Malicious Payloads in npm Dependencies

The payload is obfuscated within helper files, downloading a second-stage binary when the library is imported. Security teams detected the behavior due to anomalous network traffic to known command-and-control servers.

Securing Node.js Supply Chains from RAT Injections

The registry has removed the compromised versions, and developers are advised to audit their package locks and rotate credentials immediately.