Two npm beta releases in the @joyfill namespace contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions. Static analysis shows that its primary branch reaches a 77 KB Node.js remote-access trojan.
highSupply chain·
AGS-2026-0010
Two Joyfill npm Beta Releases Compromised
Affected
- namePattern
- joyfill/layouts
- versionRange
- 0.1.2-2773.beta.0
- namePattern
- joyfill/components
- versionRange
- 4.0.0-rc24-2773-beta.4
Self-check
AgentGuard subscribers receive this advisory automatically and their local guard runs the inspection below.
Inspect paths
/.nvm/**/node_modules//.openclaw/**/node_modules//.npm/_npx/./Library/Caches/*%LOCALAPPDATA%\npm-cache\_npx\
Remediation: uninstall— 1.Check Joyfill Dependency Versions
# Check installed npm packages for compromised beta versions
npm list | grep -E "@joyfill/.*(0\.1\.2-2773\.beta\.0|4\.0\.0-rc24-2773-beta\.4)"
# Check the project's lockfile (package-lock.json)
grep -E "@joyfill/(layouts|components)" package-lock.json -A2 | grep -E "0\.1\.2-2773\.beta\.0|4\.0\.0-rc24-2773-beta\.4"
2.Check Critical File Hashes
# Verify whether critical files in dependencies match the known malicious SHA-256 hashes
sha256sum node_modules/@joyfill/layouts/dist/index.cjs.js 2>/dev/null
# Malicious SHA-256: 8e8b90dedd456ded0c5748119836e1ca1066112bc569c1b41ca70eb931d1d4dc
sha256sum node_modules/@joyfill/components/dist/index.js 2>/dev/null
# Malicious SHA-256: 1352ad22c99983d91e600348b7cbf58235131b1ee34cea9f09623206d5b7dea7
3.Check Developer Tool & System Persistence Indicators
# Check if malware staging directories exist (indicates host scanning by infostealer)
ls -d ~/.npm/.npm /tmp/.npm 2>/dev/null && echo "🚨 COMPROMISED: Stealer staging directory detected"
# Check for malicious injection markers in VS Code / Cursor / GitHub Desktop / npm CLI
grep -rn "C2506" ~/.vscode/extensions/ 2>/dev/null
grep -rn "RS260605" $(npm root -g)/npm/lib/cli.js 2>/dev/null
4.Lock or Rollback to Safe Versions
// Example: package.json (Pin to officially verified safe non-beta versions)
{
"dependencies": {
"@joyfill/layouts": "0.1.1",
"@joyfill/components": "4.0.0-rc24"
}
}