Compromised npm packages turned Joyfill imports into a RAT

At a glance

What this is: This is a threat-intel analysis of compromised Joyfill npm packages that shipped an obfuscated remote access trojan and credential stealer, with the key finding that the payload ran when the package was imported, not when scripts were installed.

Why it matters: It matters because CI/CD pipelines, developer laptops, and build environments can be compromised by trusted package imports, forcing IAM, NHI, and secrets governance teams to treat dependency trust as an access-control problem.

By the numbers:

• StepSecurity found that malicious beta versions of @joyfill/components and @joyfill/layouts were published on July 28, 2026, and the payload ran on import rather than on install.
• The malicious package content was concentrated in roughly 333 lines of obfuscated code across the ES module and CommonJS bundles, according to StepSecurity.

👉 Read StepSecurity’s analysis of compromised Joyfill npm packages and import-time malware

Context

Compromised open-source packages are a supply chain problem, but they also become an identity and secrets problem as soon as imported code can reach developer credentials, tokens, and CI environments. In this case, the malicious Joyfill beta releases bypassed the usual assumption that npm install protections are enough, because the payload activated at import time inside normal build and test workflows.

For IAM and NHI teams, the relevant boundary is not only package integrity but also the privileged material available to the process that imports the package. A build runner, developer workstation, or test container often has access to Git tokens, npm tokens, cloud credentials, and browser-stored secrets, which turns a dependency compromise into credential exposure. This pattern is increasingly typical, not exceptional.

The deeper issue is that modern software delivery trusts transitive code execution far more than it tracks it. When a package can execute before security tooling sees a postinstall hook, teams need controls that inspect provenance, runtime behavior, and the secrets available in the execution context.

Key questions

Q: What breaks when malicious npm packages execute on import instead of install?

A: Install-time controls often miss import-time payloads because the malicious code lives in the published bundle and runs when the module loads. That means unit tests, bundlers, dev servers, and CI jobs can all trigger execution before a postinstall safeguard ever matters. Teams need artifact validation and runtime detection, not only script blocking.

Q: Why do developer installs create NHI risk as well as endpoint risk?

A: Because the install path often depends on tokens, service accounts, API keys, and delegated access that are non-human identities in practice. If those credentials are exposed, reused, or overprivileged, a malicious install can pivot from local execution to broader environment compromise. Governance has to cover both the software and the identities behind it.

Q: How can security teams detect package supply chain attacks that hide their C2 infrastructure?

A: Look for unusual outbound traffic from build or developer processes to public APIs that have no business purpose in software delivery, especially blockchain lookup services or short-lived pointer channels. Pair that with artifact diffing, package provenance review, and behavioral sandboxes that observe import-time activity. Static IOC lists alone are not enough.

Q: What should teams do after a malicious dependency is discovered?

A: Contain the affected endpoints, revoke any credentials that were reachable from those systems, and rebuild trust from known-clean environments. Then review where secrets are stored, not just which package was compromised. If the same workstation holds cloud, SSH, and SaaS credentials, the incident response plan must cover all three identity domains.

Technical breakdown

Why import-time malware bypasses npm install controls

This compromise worked because the malicious code was embedded in the distributed bundle and executed when an application imported the package. That matters because npm install --ignore-scripts only blocks install hooks, not runtime module loading. In Node.js, an import can trigger arbitrary JavaScript during unit tests, bundling, local development, or deployment. If the package ships as a compiled tarball with the payload already present, source review alone may miss it unless teams compare built artifacts, not just repository diffs.

Practical implication: validate published package tarballs and scan import-time behavior, not just install scripts.

How blockchain-based command and control hides in plain sight

The implant did not hardcode its live command-and-control server. Instead, it resolved a pointer through public blockchain transactions, then decrypted the real endpoint in memory. This design shifts the observable indicator from a static IP or domain to a legitimate public API request, which makes network filtering and signature-based detection less effective. The malware also used layered string obfuscation and in-memory decoding so indicators such as socket.io, child_process, and command strings did not appear in clear text until execution.

Practical implication: monitor for unexpected blockchain API lookups from build and developer processes.

Why a credential stealer in an npm package becomes an identity event

The final stage was not only remote access. It also staged a Python credential stealer and targeted local secrets, which is why this is an identity compromise as much as a malware event. In practice, the attack path can expose browser credentials, Git and GitHub tokens, npm tokens, wallet keys, and any cloud credentials available on the machine. That creates a direct bridge between software supply chain compromise and NHI governance, because non-human and human credentials often coexist on the same endpoint.

Practical implication: treat any compromised developer host as a secrets exposure event and rotate affected credentials immediately.

Threat narrative

Attacker objective: The attacker’s objective was to gain remote access to developer and CI environments and harvest credentials that could be reused for broader supply chain compromise.

1. Entry occurred when attackers published malicious beta npm packages that looked legitimate but carried an obfuscated payload in the tarball.
2. Credential access began once the import-time loader exposed Node primitives, resolved command and control, and staged a credential stealer on the host.
3. Impact followed through remote access, file transfer, and credential theft from developer or CI environments that trusted the compromised packages.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Mastra npm Supply Chain Attack — Sapphire Sleet — North Korean Sapphire Sleet backdoors 144 AI npm packages in 88 minutes via supply chain attack on Mastra ecosystem.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Import-time execution is the control failure that most teams still underestimate. The security model for package hygiene often stops at install hooks and known malicious versions, but this compromise executed when the package was imported inside ordinary workflows. That means the attack surface includes bundlers, test runners, and build agents that are already trusted to execute code. Practitioners should assume that published artifacts, not just source repositories, can carry active payloads.

This is a secrets exposure event, not just a software supply chain event. The payload was built to reach developer credentials and machine tokens on endpoints that routinely sit at the intersection of human identity and NHI. That creates a governance gap where identity teams own the secrets, engineering teams own the pipeline, and neither has complete visibility into the runtime trust boundary. The practical conclusion is that credential inventory must extend to developer devices and build containers.

Blockchain-based command and control creates a visibility gap that traditional allowlists do not close. When the malware hides its live infrastructure behind public blockchain APIs, defenders lose the usual static indicators that make package compromise easier to block. The named concept here is deferred infrastructure resolution: the attacker delays the real endpoint decision until execution time, which weakens pre-execution screening. Teams should align detection to runtime resolution behavior, not just to known bad hosts.

Workspace compromise now has direct identity consequences for non-human identities. If a developer machine or CI runner holds Git, npm, cloud, or browser secrets, one imported package can create cross-domain exposure that reaches beyond the endpoint. That is why NHI governance cannot be isolated from endpoint and supply chain controls. The actionable position is to treat the endpoint as part of the identity perimeter whenever secrets are available to code execution.

Package provenance and runtime privilege need to be governed together. The article shows a package that was benign in source form but hostile in published form, which means provenance checks alone are incomplete. NHI and IAM programmes should extend least-privilege thinking to the process that imports code, not only to the credentials the code uses. The practical conclusion is to bind software trust to execution context and secrets scope.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• That visibility gap breaks downstream governance as well, because 38% report no or low visibility and 47% only partial visibility into those connections.
• For a broader control perspective, see Ultimate Guide to NHIs , Static vs Dynamic Secrets for how exposure windows change when credentials are long-lived.

What this signals

Deferred infrastructure resolution is a useful name for malware that waits until execution time to reveal its live command path. That pattern matters to software delivery teams because static allowlists and package reputation checks are weakest exactly where the attacker has moved the decision point. The practical response is to combine provenance controls with runtime network inspection and endpoint telemetry.

This compromise also reinforces that identity teams cannot separate NHI governance from developer endpoint governance. When a build host or laptop carries cloud tokens, Git credentials, or browser secrets, a package import can become a credential event. Teams should align secrets inventory, endpoint containment, and rotation workflows so that an imported dependency cannot become a standing access path.

For practitioners, the signal is clear: treat package trust as a living control, not a one-time approval. Where a compromised dependency reaches a build or developer system, the right metric is not just whether the package was removed but whether every reachable credential was identified and rotated.

For practitioners

• Block import-time risk in dependency pipelines Add controls that inspect published tarballs, compare built bundles against source, and flag unexpected code execution during import in CI and developer environments.
• Treat developer machines as secret-bearing assets Inventory browser secrets, Git tokens, npm tokens, cloud credentials, and wallet keys on any host that imported the compromised packages, then rotate them as an exposure set.
• Detect blockchain lookup behavior from build processes Alert on outbound calls from Node.js processes to public blockchain APIs such as Tron, BNB Smart Chain, or Aptos when they occur during package installation, import, or test execution.
• Pin trusted packages and quarantine prerelease builds Restrict prerelease dependency consumption, pin known-good versions, and require provenance review for any package that ships a partial or unusually small tarball compared with sibling releases.
• Correlate endpoint telemetry with secrets rotation When a compromised package is confirmed, use endpoint telemetry to scope which machines imported it and trigger immediate credential rotation for all secrets available on those systems.

Key takeaways

• This compromise shows that npm imports can execute malicious code before install-time defenses ever matter.
• The attack is especially dangerous because it turns developer and CI hosts into credential exposure points for both human and non-human identities.
• The right response is to verify published artifacts, watch for runtime resolution behavior, and rotate every secret reachable from affected machines.

Key terms

• Import-Time Malware: Malware that executes when a package or module is loaded, rather than waiting for an install hook or separate launcher. In software supply chains, this makes ordinary imports in tests, builds, and runtime services a viable attack trigger.
• Deferred Infrastructure Resolution: A technique where the attacker delays the real command-and-control endpoint until execution time by using a pointer, lookup service, or encrypted indirection. It reduces static detection value because the malicious package does not contain the live server in clear text.
• Secret-Bearing Endpoint: A workstation, container, or build runner that stores or can access credentials needed by applications and automation. These endpoints are high-value because one compromise can expose both human and non-human identities, including tokens, API keys, and cloud credentials.

What's in the full analysis

StepSecurity's full article covers the operational detail this post intentionally leaves for the source:

• The exact obfuscation chain used in the malicious bundles and how the decoder stages were extracted from the tarballs.
• The full indicator set for the command-and-control infrastructure, blockchain pointer channels, and file hashes associated with the campaign.
• The package-by-package recovery steps for repositories, CI/CD runners, and developer laptops that imported the compromised prereleases.
• The detection logic behind Harden-Runner, OSS AI scanning, and Dev Machine Guard for this specific campaign.

👉 StepSecurity’s full post covers the attack chain, indicators of compromise, and recovery steps in detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader security workflows where credentials are actually exposed.