Malicious beta versions of the npm packages @joyfill/components and @joyfill/layouts were found to contain an obfuscated remote access trojan (RAT) and credential stealer. The compromise represents a supply chain attack targeting developers who install these packages. StepSecurity published a full analysis including indicators of compromise (IOCs) and remediation steps. The malicious code was hidden within what appeared to be legitimate beta releases of the Joyfill UI component library. Users of these packages are advised to audit their dependencies and remove affected versions immediately.