Compromised npm Packages Deliver RAT via Blockchain-Resolved Payloads

Attackers injected malicious code into beta versions of two legitimate npm packages, turning a trusted dependency into a remote access trojan (RAT) delivery mechanism. The use of blockchain transactions to resolve encrypted payloads is a novel evasion technique that bypasses traditional domain-based blocklists and makes takedowns significantly harder. A secondary Python infostealer further expands the attack surface, targeting credentials and sensitive data from developer machines. This incident highlights the acute danger of consuming unvetted or pre-release package versions in development pipelines without integrity verification. Supply chain attacks of this nature can propagate silently across hundreds of downstream projects before detection.

Tactical Insight

Immediate actions

Audit all current Node.js projects for dependencies on `@joyfill/layouts` and `@joyfill/components` and remove or pin to verified safe versions immediately.
Run endpoint detection scans on any developer machines that imported these packages to identify RAT or infostealer artifacts.

Long-term improvements

Enforce the use of a private npm registry or artifact proxy (e.g., Verdaccio, Artifactory) with an allowlist policy to block unapproved or beta packages.
Implement Software Composition Analysis (SCA) tooling in CI/CD pipelines to automatically flag newly published or modified package versions before they reach build environments.
Adopt a lockfile strategy (`package-lock.json` or `yarn.lock`) with integrity hash verification and prohibit automatic upgrades to pre-release or beta versions in production pipelines.

Detection measures

Monitor outbound network connections from build servers and developer machines for unusual traffic to blockchain RPC endpoints (Tron, Aptos, BNB Smart Chain).
Alert on unexpected spawning of detached Node.js or Python child processes originating from package installation lifecycle scripts (`preinstall`, `postinstall`).