npm install of compromised @joyfill beta packages

Ethan Andrews@eandrews

•updated Jul 29, 2026•25•0•40

Detects the execution of npm, pnpm, or yarn commands used to install or add specific beta releases of the @joyfill/layouts and @joyfill/components packages, which are known to contain malicious code designed to deliver a multi-stage RAT.