Malicious beta versions of two popular Joyfill npm packages, @joyfill/components and @joyfill/layouts, were found to contain an obfuscated remote access trojan (RAT) and credential stealer. The compromise represents a software supply chain attack targeting developers who install or update these packages. StepSecurity published a full analysis including indicators of compromise (IOCs) and remediation steps. The malicious code was hidden using obfuscation techniques to evade detection. Affected users are advised to audit their environments and remove the compromised versions immediately. This incident highlights ongoing risks in open-source package ecosystems like npm.