Executive Summary
On July 28, 2026, two legitimate npm packages, @joyfill/components and @joyfill/layouts, were compromised via hijacked maintainer accounts or CI/CD workflows. The attacker published malicious beta versions (2773 series) containing a heavily obfuscated remote access trojan (RAT) known as PolinRider. The malware is notable for its 'import-time' execution, meaning it triggers when the library is required in code rather than during installation, bypassing security controls that only monitor install hooks.
The attack utilizes a sophisticated five-stage chain that leverages public blockchain transactions (Tron, BNB Smart Chain, and Aptos) to resolve its command-and-control (C2) infrastructure. This technique effectively hides the attacker's final server address from static analysis and registry scanners. The final stage deploys a Socket.IO RAT and a Python-based credential stealer designed to exfiltrate browser data, SSH keys, and cloud provider credentials.
This campaign represents a critical risk to developer workstations and CI/CD pipelines. By infecting the global npm CLI, the malware achieves persistence and potential self-propagation, turning every subsequent package publish from an infected machine into a new supply chain vector. Affected organizations should immediately audit their lockfiles and rotate all credentials present on systems where these versions were loaded.