Joyfill npm Supply-Chain Compromise — Import-Time RAT on Developer Workstations

On 2026-07-28 an attacker published malicious prerelease builds of two Joyfill npm packages — @joyfill/components (4.0.0-rc24-2773-beta.4/.5/.6) and @joyfill/layouts (0.1.2-2773.beta.0/.1/.2). Both carry the same obfuscated implant welded into the distribution bundles, not the source tree. The attacker's objective is not the CI runner: it is the developer workstation, where a Socket.IO remote-access trojan opens an interactive shell and a Python stealer harvests browser credentials, browser-extension wallets and password managers, Git and GitHub CLI credentials, and OS keychains.

The defining characteristic — and the reason most package-security controls miss it — is that execution is triggered by import, not by install. There is no postinstall hook anywhere in package.json, so npm install --ignore-scripts, install-hook sandboxes, and lifecycle-script scanners all pass the package clean. Any unit test, bundler run, dev server, SSR render, or production deploy that loads the module is sufficient to start the chain.

Stage 1 is also deliberately invisible to network-reputation controls: its only outbound contacts are legitimate public blockchain APIs. The implant reads the latest outbound transaction from a fixed Tron address, follows the pointer to a BNB Smart Chain transaction, XOR-decrypts the transaction input, and evaluates it. Aptos is the fallback pointer channel. That means the operator can rotate the live C2 without republishing anything, and blocking a C2 domain does not break the resolution step.

The highest-value defensive angle is therefore endpoint behavior on the developer workstation, not registry scanning. Four behaviors are near-unmistakable: a detached node -e child process carrying an inline campaign tag; a Node process shelling out to python, Get-Clipboard, pbpaste, xclip or tasklist; a runtime npm --prefix "<tmp>" install socket.io-client; and modification of the global npm CLI (lib/cli.js), GitHub Desktop's main.js, the Discord desktop core module, or the @vscode/deviceid module used by VS Code, Cursor and Antigravity.

Patching the global npm CLI is the worm loop and the reason this is not a contained incident: once npm/lib/cli.js is injected, every subsequent npm invocation on that machine re-executes the loader, and anything built or published from that workstation can carry the implant onward.

Defender priority: treat any host that imported a 2773 prerelease as interactively compromised, not merely exposed. Isolate it, then rotate every credential reachable from that Node process — npm tokens, Git/GitHub PATs and gh CLI config, browser-saved passwords and cookies, wallet and password-manager browser extensions, cloud keys — from a separate clean machine. Reinstalling the package does not remove persistence written into VS Code, Discord, GitHub Desktop or the global npm CLI.

Five sources fetched and snapshotted verbatim on 2026-08-02 into the pack's -sources/ directory. Every atomic indicator shipped below traces to at least one of them. Two are primary vendor analyses with independent code recovery; the remaining three are secondary reporting used only for corroboration, not for new indicators.

Research decisions

• Blockchain endpoints are hunt-only, never block. api.trongrid.io, fullnode.mainnet.aptoslabs.com, bsc-dataseed.binance.org, bsc-rpc.publicnode.com and ip-api.com are legitimate public services. They are excluded from the Falcon import CSV and routed to a hunt query instead. Blocking them would break real web3 development and would not stop the implant, which reaches them over allowlisted HTTPS.
• Two vendors disagree on scope in one place. StepSecurity lists all six 2773 prereleases as carrying the payload; Socket analysed @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4 in depth and notes the components Rollup bundle ships a throwing dynamic-require shim that limits execution in that specific artifact. This pack treats all six as compromised — the safe read — and flags the components artifact as lower-yield for live-execution telemetry.
• Attribution is family-level, not actor-level. Socket assesses the loader as PolinRider-family and the RAT as DEV#POPPER on code overlap, and rates the Python stealer as an OmniStealer iteration at medium likelihood. No group attribution is claimed and none is carried into this pack.
• Detonation caveat. StepSecurity's sandbox runs produced no outbound C2 callout, most plausibly because the on-chain configuration was taken down within hours of disclosure. Live C2 telemetry may therefore be absent even on genuinely infected hosts — which is exactly why the behavioral queries in section 8 outrank the IP list in section 10.

Attack chain

Hunt hypotheses (ordered by fidelity)

Known gap carried into the coverage map: stage 0 (how the publishing credential was compromised) has no endpoint telemetry — it happened at the registry. Stage 1's in-memory decoding likewise leaves no artifact on disk. Both are covered only by lockfile hygiene and registry-side controls, not by CQL.

Run these first — they are cheap, need no EDR, and answer "am I affected" faster than any query. All are read-only inventory checks. Nothing here installs, downloads, or executes any part of the malicious package.

1 · Lockfile and dependency-tree sweep (all repos, all build images)

grep -rEn 'joyfill.*2773' package-lock.json yarn.lock pnpm-lock.yaml

# recursive across a repo tree
grep -rEn --include='*lock*' 'joyfill.*2773' .

# resolved tree, per project
npm ls @joyfill/components @joyfill/layouts --all 2>/dev/null

2 · Injection-sentinel scan on developer workstations

The loader stub is wrapped in fixed comment sentinels. Scanning for those tags is the single highest-yield workstation check, and it is what tells you the machine is persistently infected rather than merely exposed.

# macOS / Linux
grep -rIl -E 'C25061[789]A|C250620A|C26051[12]A|RS260605|9-0135-3' \
  ~/.npm-global ~/.nvm /usr/local/lib/node_modules /usr/lib/node_modules \
  "/Applications/Visual Studio Code.app/Contents/Resources/app/node_modules/@vscode/deviceid" \
  "/Applications/Discord.app/Contents/Resources" \
  "/Applications/GitHub Desktop.app/Contents/Resources/app" 2>/dev/null

# resolve the global npm CLI first, then inspect only that file
npm root -g
grep -c -E 'C25061[789]A|RS260605' "$(npm root -g)/npm/lib/cli.js"

# Windows (PowerShell)
$paths = @(
  "$env:APPDATA\npm\node_modules\npm\lib\cli.js",
  "$env:LOCALAPPDATA\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\deviceid",
  "$env:LOCALAPPDATA\Discord",
  "$env:LOCALAPPDATA\GitHubDesktop"
)
Select-String -Path $paths -Include *.js -Recurse -ErrorAction SilentlyContinue `
  -Pattern 'C25061[789]A|C250620A|C26051[12]A|RS260605|9-0135-3' |
  Select-Object Path, LineNumber | Format-Table -AutoSize

3 · Credential staging directory check

# the npm cache lives here legitimately, but it holds no archives
ls -la ~/.npm/*.zip ~/.npm/*.7z /tmp/.npm 2>/dev/null
# Windows
Get-ChildItem "$env:USERPROFILE\.npm" -Include *.zip,*.7z -Recurse -ErrorAction SilentlyContinue

4 · Egress / proxy log hunts

• Any request carrying the header Sec-V: — this header is not part of any standard and is a single-source signal for this family.
• Requests to the paths /$/boot, /u/e, /u/f, /0x/js, /verify-human/, /snv, /d/python.zip, /d/7zr.exe, /d/python.7z against any destination, not just the known IPs — the operator rotates hosts on-chain.
• Plain-HTTP traffic to port 443 (the malware writes http://166.88.134.62:443) — a protocol/port mismatch that most gateways can flag generically.
• Outbound to port 27017 from a workstation or build agent.
• Blockchain RPC lookups from CI runners: per the Socket analysis, blockchain RPC traffic from a build agent is a high-fidelity signal on its own, because build agents have no legitimate reason to talk to Tron, Aptos or BSC.

5 · Registry and identity-side checks

• Internal registry proxy / mirror audit log: did any client fetch a 2773 prerelease tarball, and is a copy still cached?
• npm audit log for tokens belonging to users on affected machines — publishes, token creations, 2FA changes since 2026-07-28.
• GitHub/GitLab audit log: new PATs, new SSH keys, new OAuth grants, or pushes from unfamiliar IPs by users on affected machines.
• IdP sign-in logs for the affected users: impossible-travel or new-device sign-ins using browser-stored session cookies.

No query below carries an in-query time filter. Set the lookback with the console time picker; each query records its intended window as a // LOOKBACK: comment. Start at 30 days — the packages were published 2026-07-28.

// HUNT: Joyfill / DEV#POPPER campaign C2 contact from any process
// MITRE: T1071.001, T1105, T1041 | CONF: high  FP: low  COST: low | REQUIRES: NetworkConnectIP4
// LOOKBACK: 30d (set in the console time picker)
#event_simpleName=/^NetworkConnectIP4$/
| in(RemoteAddressIP4, values=["166.88.134.62", "23.27.13.43", "198.105.127.210", "23.27.202.27"])
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, ContextProcessId, RemoteAddressIP4, RemotePort, LocalAddressIP4])

// HUNT: dead-drop C2 resolution - blockchain RPC lookups from node/npm
// MITRE: T1102.001, T1614 | CONF: medium  FP: medium  COST: low | REQUIRES: DnsRequest
// LOOKBACK: 30d (set in the console time picker)
// FALSE POSITIVES: real web3 development, blockchain SDK tests, wallet browser extensions.
// TUNING: exclude the asset group that legitimately does web3 work, then alert only on hosts
//   outside it. On a build agent this needs no tuning at all - a CI runner has no reason to
//   resolve Tron/Aptos/BSC, so scope this query to the CI asset group for a high-fidelity variant.
#event_simpleName=/^DnsRequest$/
| DomainName=/^(api\.trongrid\.io|fullnode\.mainnet\.aptoslabs\.com|bsc-dataseed\.binance\.org|bsc-rpc\.publicnode\.com|ip-api\.com)$/i
| ContextBaseFileName=/^(node|npm|npx|yarn|pnpm)(\.exe|\.cmd)?$/i
| groupBy([aid, ComputerName, ContextBaseFileName, DomainName], function=count(as=Lookups))
| sort(Lookups, order=desc)

// HUNT: detached "node -e" child carrying the A9-0135-3 campaign tag (loader branch B)
// MITRE: T1059.007, T1027 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// LOOKBACK: 30d (set in the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^node(\.exe)?$/i
| CommandLine=/\s-e\s/
| CommandLine=/global\[|_V|A9-0135-3|_p_t/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, GrandparentBaseFileName, FileName, CommandLine, TargetProcessId, ParentProcessId])

// HUNT: RAT dependency self-healing - runtime npm install into a scratch prefix
// MITRE: T1105, T1059.007 | CONF: high  FP: medium  COST: low | REQUIRES: ProcessRollup2
// LOOKBACK: 30d (set in the console time picker)
// FALSE POSITIVES: project scaffolders and e2e test harnesses that install packages at runtime.
// TUNING: exclude command lines whose --prefix target sits inside a known repo root, and exclude
//   your CI image build steps by ParentBaseFileName. What remains - an install into a temp or
//   profile-local path, parented by node rather than a shell - is the signal.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/\bnpm\b/i
| CommandLine=/\binstall\b|\bi\s/i
| CommandLine=/--prefix/i
| CommandLine=/socket\.io-client|form-data|\baxios\b/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, TargetProcessId])

// HUNT: node spawning python - DEV#POPPER "~py" verb staging the credential stealer
// MITRE: T1059.006, T1555.003 | CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2
// LOOKBACK: 30d (set in the console time picker)
// FALSE POSITIVES: node-gyp and native-module builds (sharp, canvas, prebuild) call python legitimately.
// TUNING: exclude ParentCommandLine matching node-gyp, gyp, prebuild, node-pre-gyp and your own
//   build wrappers. Prioritise rows where GrandparentBaseFileName is node - i.e. the parent node was
//   itself spawned by another node process, which is the detached "-e" child shape from Q3.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^node(\.exe)?$/i
| FileName=/^(python3?|pythonw|py)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, GrandparentBaseFileName, ParentBaseFileName, FileName, CommandLine, TargetProcessId, ParentProcessId])

// HUNT: clipboard theft - node-parented clipboard READ (ss_cb verb)
// MITRE: T1115, T1059.001, T1059.004 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// LOOKBACK: 30d (set in the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(node|npm|npx)(\.exe|\.cmd)?$/i
| FileName=/^(powershell|pwsh|pbpaste|xclip|xsel)(\.exe)?$/i
| CommandLine=/Get-Clipboard|pbpaste|selection\s+clipboard|--clipboard|--output/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, TargetProcessId, ParentProcessId])

// HUNT: node-parented host/process reconnaissance (ss_info fingerprinting)
// MITRE: T1057, T1082 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// LOOKBACK: 30d (set in the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(node|npm|npx)(\.exe|\.cmd)?$/i
| FileName=/^(tasklist|systeminfo|whoami|hostname|wmic)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, TargetProcessId, ParentProcessId])

// HUNT: worm re-injection - modification of npm CLI / GitHub Desktop / Discord core / @vscode/deviceid
// MITRE: T1554 | CONF: medium  FP: medium  COST: medium | REQUIRES: CriticalFileModified
//   (script-file write visibility is sensor-policy dependent - validate in tenant before relying on this)
// LOOKBACK: 30d (set in the console time picker)
// FALSE POSITIVES: vendor self-updates (VS Code, Cursor, Discord, GitHub Desktop) and "npm install -g npm".
// TUNING: exclude ContextBaseFileName matching the vendor updaters - Code, Cursor, Update, Squirrel,
//   GitHubDesktop, Discord - and exclude node when its command line is a deliberate global npm upgrade.
//   Anything left, especially a write by a node process with no interactive parent, is the signal.
#event_simpleName=/^CriticalFileModified$/
| TargetFileName=/(deviceid.{0,60}index\.js|discord_desktop_core.{0,60}index\.js|resources.{0,20}app.{0,20}main\.js|npm.{0,20}lib.{0,10}cli\.js)$/i
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, ContextProcessId, TargetFileName])

// HUNT: recovered Joyfill / DEV#POPPER payload and tarball hashes
// MITRE: T1195.002, T1105 | CONF: medium  FP: low  COST: low
// REQUIRES: ProcessRollup2, PeFileWritten, NewExecutableWritten, ZipFileWritten
// LOOKBACK: 30d (set in the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten|ZipFileWritten)$/
| in(SHA256HashData, values=[
    "26351aed0397158d3a3b8cc8fd3047d4c015d264c9895f10f20f1521b974ed18",
    "36ff00b45e67baa7e3674b0c80f48e88737264c61e5c6b3b091200972de8157c",
    "cb46f12d70824ea24ed1f8bcf45bf3f86680e02a9089aafc03b27f691be57be3",
    "78f0de8682e0e894a5784eb7e95db4da6088f528918ca3107dd1e76f80a561d8",
    "adc4af90540d33cd1e98f44b51482ae9250fbeb97d6f8d7841c81b618cb2c6e6",
    "bcc93dc55bc7daedf4ca57254f0e7a7f1c40e09851eab98fe10cde801982db17"])
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, TargetFileName, SHA256HashData, CommandLine])

// HUNT: package manager invoked against a compromised Joyfill 2773 prerelease
// MITRE: T1195.002 | CONF: medium  FP: low  COST: low | REQUIRES: ProcessRollup2
// LOOKBACK: 30d (set in the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(npm|npx|yarn|pnpm|node)(\.exe|\.cmd)?$/i
| CommandLine=/joyfill/i
| CommandLine=/2773/
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, TargetProcessId])

// HUNT: credential exfil staging - encrypted archive written under a .npm directory
// MITRE: T1560.001, T1005, T1041 | CONF: medium  FP: medium  COST: low | REQUIRES: ZipFileWritten
// LOOKBACK: 30d (set in the console time picker)
// FALSE POSITIVES: manual archiving in the home directory; cache-snapshot tooling.
// TUNING: exclude TargetFileName containing _cacache or _logs (the legitimate npm cache layout), and
//   exclude your backup or cache-warming agents by ContextBaseFileName. A python or node process
//   writing an archive there is the signal - the npm cache is never a .zip or .7z.
#event_simpleName=/^ZipFileWritten$/
| TargetFileName=/\.npm.{0,120}\.(zip|7z)$/i
| ContextBaseFileName=/^(python3?|pythonw|py|node)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, ContextProcessId, TargetFileName, FileSize])

Three queries are strong enough to promote to Custom IOAs. The rest stay Investigate-only hunts. Deploy every IOA in Detect first on a pilot host group, review a full week of hits, then move to Prevent only where noted.

IOA-1 — Detached node -e with an inline campaign tag Promote

• Rule group: Process Creation (Windows / Mac / Linux).
• Image filename: .*\\node\.exe (Windows) / .*/node (Mac, Linux).
• Command line: .*\s-e\s.*global\[.*_V.*
• Action: Detect (Critical). Move to Prevent once a clean week is confirmed — the pattern has no known benign use.
• Exclusions: none expected. If a homegrown tool matches, exclude by parent image path rather than loosening the command-line pattern.
• Deployment path: Endpoint Security → Custom IOA Rule Groups → new Process Creation rule → assign to a Prevention Policy → pilot host group first.

IOA-2 — Node-parented clipboard read Promote

• Rule group: Process Creation, all platforms.
• Parent image filename: .*(\\|/)(node|npm|npx)(\.exe|\.cmd)?
• Image filename: .*(\\|/)(powershell\.exe|pwsh|pbpaste|xclip|xsel)
• Command line: .*(Get-Clipboard|pbpaste|selection\s+clipboard|--clipboard).*
• Action: Detect (High). Keep at Detect — a rare Electron helper could legitimately read the clipboard.
• Exclusions: exclude any approved internal CLI that offers a "paste from clipboard" feature, by parent image path.

IOA-3 — Runtime npm --prefix install of RAT dependencies Promote with tuning

• Rule group: Process Creation, all platforms.
• Command line: .*npm.*--prefix.*(socket\.io-client|axios|form-data).*
• Action: Detect (High). Do not set Prevent — blocking an npm install on a developer machine causes real disruption.
• Exclusions: exclude prefixes inside known repository roots and your CI image build steps before enabling.

Investigate-only (do not promote)

• Q2 — blockchain RPC lookups: too environment-dependent for an IOA. Run as a Scheduled Search scoped to the CI asset group, where it is genuinely high fidelity.
• Q5 — node → python: node-gyp makes this too noisy for a prevention rule. Scheduled Search with the node-gyp exclusion applied.
• Q8 — developer-tool file modification: depends on file-monitoring policy and on excluding vendor updaters; keep as a weekly Scheduled Search until the FP profile is measured.
• Q1 / Q9 — atomic indicators: these belong in Falcon IOC Management (section 10), not in a Custom IOA. IOC Management gives you retroactive matching and expiry handling that an IOA does not.

Scheduled Search recommendations

Four copy-ready blocks. The CSV is the only block intended for bulk import into Falcon IOC Management; everything else is hunt, pivot, or audit material. Blockchain RPC endpoints are deliberately excluded from the CSV — they are legitimate public services and blocking them breaks real development without stopping the implant.

type,value,action,severity,expiration,description,tags
ipv4,166.88.134.62,detect,critical,2027-02-02,Socket.IO C2 and upload host for campaign A9-0135-3,campaign:Joyfill-npm
ipv4,23.27.13.43,detect,critical,2027-02-02,Serves the detached branch /$/boot downloader,campaign:Joyfill-npm
ipv4,198.105.127.210,detect,high,2027-02-02,Alternate campaign C2 profile,campaign:Joyfill-npm
ipv4,23.27.202.27,detect,high,2027-02-02,Alternate campaign C2 profile including port 27017,campaign:Joyfill-npm
sha256,26351aed0397158d3a3b8cc8fd3047d4c015d264c9895f10f20f1521b974ed18,prevent,critical,2027-02-02,Final Socket.IO RAT clientCode payload,campaign:Joyfill-npm
sha256,36ff00b45e67baa7e3674b0c80f48e88737264c61e5c6b3b091200972de8157c,prevent,critical,2027-02-02,Python credential stealer,campaign:Joyfill-npm
sha256,cb46f12d70824ea24ed1f8bcf45bf3f86680e02a9089aafc03b27f691be57be3,detect,high,2027-02-02,In-process first-stage loader,campaign:Joyfill-npm
sha256,78f0de8682e0e894a5784eb7e95db4da6088f528918ca3107dd1e76f80a561d8,detect,high,2027-02-02,Detached second-stage bootstrap,campaign:Joyfill-npm
sha256,f452f9cfa539f4a1fe25187a99a484391290d5dbaa422ba455edf6b04f81b7d1,detect,medium,2027-02-02,Decoded tier-two blockchain resolver,campaign:Joyfill-npm
sha256,ae7565109fd01b88d82acf7f73ab20709cbc2c9f26fdea13e429ccc87a55d4fb,detect,medium,2027-02-02,Decoded detached bootstrap,campaign:Joyfill-npm
sha256,26e679eaf1e9baeb7c55eb48db482301171d4d26e1728544b23734a90dc70e1b,detect,medium,2027-02-02,Preserved boot response capture,campaign:Joyfill-npm
sha256,2cfede38fb121a71a2f3607474aa8cd588a99f51b37e5e6f0d8cb789fa275032,detect,medium,2027-02-02,Preserved boot response capture,campaign:Joyfill-npm
sha256,adc4af90540d33cd1e98f44b51482ae9250fbeb97d6f8d7841c81b618cb2c6e6,detect,high,2027-02-02,joyfill layouts malicious tarball,campaign:Joyfill-npm
sha256,8e8b90dedd456ded0c5748119836e1ca1066112bc569c1b41ca70eb931d1d4dc,detect,high,2027-02-02,joyfill layouts CommonJS bundle,campaign:Joyfill-npm
sha256,5f6a92006ca2ea4b464d66fb41af777edce7296939a7c6ee491e2b3cbfe09848,detect,high,2027-02-02,joyfill layouts ESM bundle,campaign:Joyfill-npm
sha256,bcc93dc55bc7daedf4ca57254f0e7a7f1c40e09851eab98fe10cde801982db17,detect,high,2027-02-02,joyfill components malicious tarball,campaign:Joyfill-npm
sha256,1352ad22c99983d91e600348b7cbf58235131b1ee34cea9f09623206d5b7dea7,detect,high,2027-02-02,joyfill components dist index js,campaign:Joyfill-npm
sha256,67c6ef602cc850f10d935fee53fa40440df841adf081563bf4fc2631a71249ce,detect,high,2027-02-02,joyfill components dist index esm js,campaign:Joyfill-npm
sha256,c5742ea1875ecd2360022624149994909cd0546e221e4203dffd01f48de45469,detect,high,2027-02-02,joyfill components dist joyfill min js,campaign:Joyfill-npm
# NOT FOR BLOCKING - legitimate public services used as the dead-drop channel.
# Hunt these with Q2 scoped to node/npm; never add them to a blocklist:
#   api.trongrid.io  fullnode.mainnet.aptoslabs.com  bsc-dataseed.binance.org
#   bsc-rpc.publicnode.com  ip-api.com

# Behavioral signatures - portable across EDR platforms.
# These survive C2 rotation; the IP list does not.

BEH-01  node spawns a detached "-e" child whose inline script assigns global['_V']
BEH-02  node/npm resolves Tron, Aptos or BSC RPC hosts on a machine that never had before
BEH-03  runtime "npm --prefix <temp> install socket.io-client|axios|form-data"
BEH-04  node parents a clipboard READ (Get-Clipboard | pbpaste | xclip -o | xsel --output)
BEH-05  node parents tasklist / systeminfo / whoami on a developer workstation
BEH-06  node parents python3 outside a node-gyp or native-module build
BEH-07  npm global CLI lib/cli.js modified by anything other than an npm self-upgrade
BEH-08  GitHub Desktop main.js, Discord core index.js or @vscode/deviceid index.js modified
        outside a signed vendor update
BEH-09  .zip or .7z archive written under ~/.npm or /tmp/.npm
BEH-10  outbound HTTP (not TLS) to port 443, or any traffic to port 27017, from a workstation
BEH-11  any outbound request carrying an HTTP header named "Sec-V"
BEH-12  requests to paths /$/boot /u/e /u/f /0x/js /verify-human/ /snv against ANY host

# Malware families (family-level assessment, no actor attribution claimed)
loader   PolinRider-family multi-chain blockchain loader
rat      DEV#POPPER Socket.IO RAT, VERSION 260605, 77276 bytes
stealer  OmniStealer iteration (assessed medium likelihood), 82457 bytes

# Campaign markers
campaign_fragment  9-0135-3
campaign_tag       A9-0135-3
http_header        Sec-V: A9-0135-3
globals            _V  _p_t  _t_s  _t_u  _t_1  _t_2  _t_c  global.r  global.m
loader_seed        rmcej%otb%
injection_tags     C250617A C250618A C250619A C250620A C260511A C260512A RS260605
archive_password   ,./,./,./

# XOR keys (for sample triage, not for blocking)
branch_A   2[gWfGj;<:-93Z^C
branch_B   m6:tTh^D)cBz?NM]
boot_resp  ThZG+0jfXE6VAGOJ

# Dead-drop pointers - Tron addresses
TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP    branch A pointer
TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG    branch B pointer
TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v    tier-two pointer

# Aptos fallback accounts
0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e
0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3
0x533b2dbcaeff19cd1f799234a27b578d713d8fcaa341b7501e4526106483e0b1

# BNB Smart Chain payload transactions
0x18a8420f727f2405f9d1805ad887b31029b584b2ff5a7ec0f57c72635183e99d
0x7ffb4efddd96e20aec90724be2ac9a71c138a9af697b9fb8224bbf80ea4f22be
0xb6c725890be6890fd2c735eedc47e24b85a350301f6c19a3864e43c35e470968

# Sandbox / CI hostnames the RAT refuses to run on (why workstations matter most)
github-runner  buildbot  buildkitsandbox  sandbox-pool-  cloudchamber
microsoft-standard-WSL2  root

# 1. Compromised versions - deny in registry proxy AND remove from lockfiles
@joyfill/components@4.0.0-rc24-2773-beta.4
@joyfill/components@4.0.0-rc24-2773-beta.5
@joyfill/components@4.0.0-rc24-2773-beta.6
@joyfill/layouts@0.1.2-2773.beta.0
@joyfill/layouts@0.1.2-2773.beta.1
@joyfill/layouts@0.1.2-2773.beta.2

# 2. Known-good pins (published before 2026-07-28)
npm install @joyfill/components@4.0.0-rc24 @joyfill/layouts@0.1.1

# 3. Full clean reinstall - deleting node_modules alone is not enough
rm -rf node_modules
npm ci

# 4. Injected files to inspect on every workstation that imported the package
$(npm root -g)/npm/lib/cli.js
.../resources/app/node_modules/@vscode/deviceid/dist/index.js
.../modules/discord_desktop_core/discord_desktop_core/index.js
.../GitHub Desktop/resources/app/main.js

# 5. Credentials to rotate from a SEPARATE clean machine, in this order
npm tokens (.npmrc)          -> revoke, reissue, enable 2FA on publish
Git / GitHub PATs + SSH keys -> revoke all, reissue
gh CLI auth token            -> gh auth logout, re-login
browser saved passwords      -> rotate, then clear the profile
browser session cookies      -> revoke sessions at the IdP, not just locally
wallet + password-manager browser extensions -> treat seeds/vaults as exposed
cloud access keys on the host -> rotate; audit CloudTrail/Activity logs since 2026-07-28
OS keychain / Credential Manager entries -> enumerate and rotate

# 6. Policy controls to verify are actually on
registry proxy blocks the six versions above
package cooldown / minimum-age policy enabled for new versions
CI egress default-deny with an allowlist
--ignore-scripts is NOT relied on as a control (it does not stop this)

Work these four gates in order. Do not promote anything to Prevent until gate 4 passes. Every positive test below is benign and reproducible — none of them involve the malicious package, and none should be performed by installing it.

Gate 1 — Telemetry ready

• Confirm ProcessRollup2 volume is non-zero for your developer host group over the last 24 hours. If a whole OS platform is missing, the behavioral queries are blind there.
• Confirm DnsRequest is being collected — some policies disable it. Without it, Q2 returns nothing regardless of infection.
• Confirm ZipFileWritten fires: create a benign .zip in a scratch directory and search for it. If it does not appear, Q11 is inert.
• Confirm CriticalFileModified fires for a script-file write before trusting Q8. Touch a copy of a non-critical .js file in a monitored path and look for the event. If nothing surfaces, mark Q8 as a gap and rely on the section 7 sentinel grep instead.

Gate 2 — Benign baseline

• Run Q2 over 30 days with no exclusions and record which hosts and asset groups appear. That list is your web3 exclusion set. If the list is empty, promote Q2's fidelity rating.
• Run Q5 over 30 days and bucket by ParentCommandLine. Expect a tight cluster of node-gyp/native-module builds — those become the exclusion.
• Run Q4 and Q8 over 30 days and record the normal writers and installers so the tuning lines are grounded in your data, not assumption.
• Q1, Q3, Q6, Q7 should baseline at or near zero. Any non-zero result at this stage is an investigation, not a false positive.

Gate 3 — Positive tests (safe, no malware)

• Q3: run node -e "global['_V']='TEST';console.log(1)" on a test host. The query must return it. This validates command-line capture, which some platforms truncate.
• Q6: from a Node REPL, spawn the platform clipboard reader (pbpaste, Get-Clipboard, or xclip -selection clipboard -o). Confirm parent/child attribution is correct.
• Q7: from Node, spawn tasklist on a Windows test host.
• Q4: run npm --prefix /tmp/hunttest install axios on a test host, then delete the directory.
• Q11: write a benign .zip into ~/.npm/ from a Python one-liner, confirm the hit, then remove it.
• Q1/Q9: do not synthesise a positive test against live attacker infrastructure. Validate the mechanism instead by temporarily swapping in a known-reachable internal address and hash, confirming a hit, then reverting.

Gate 4 — Promotion criteria

• Seven consecutive days at zero false positives → eligible for Custom IOA at Detect.
• A further seven days at Detect with zero false positives, and no known benign use of the pattern → eligible for Prevent (IOA-1 only).
• Any query still producing more than roughly five FPs per week stays a Scheduled Search with the documented exclusions applied.
• Re-baseline after any change to the developer toolchain — a new bundler or test runner can shift the Node process-tree shape underneath every query here.

The controls below are ordered by deployment friction, not importance. Every one is anchored to a MITRE mitigation and, where a benchmark covers the technology, to that benchmark. Where no formal benchmark exists for the developer-tooling surface, the control is marked as best-practice rather than dropped — the gap in published benchmarks is not a reason to leave the workstation unhardened.

Four playbooks. Every step carries prerequisites, reboot impact, and a rollback — including where the honest rollback is "none required", with the reason. Run playbook 1 fleet-wide before playbook 2, because the inventory result decides who needs remediation.

Playbook 1 — Fleet exposure sweep (read-only)

Prerequisites: read access to all repositories and to developer endpoints (RTR or equivalent). No elevation required. Reboot required: no. Rollback: none required — every command is read-only and changes no state.

# 1.1  Repository / lockfile sweep (run from an SCM-wide checkout or via code search)
grep -rEn --include='*lock*' 'joyfill.*2773' .

# 1.2  Build images and caches (run inside each base image)
grep -rEn 'joyfill.*2773' /app /srv /opt 2>/dev/null
ls ~/.npm/_cacache 2>/dev/null && npm cache ls 2>/dev/null | grep -i joyfill

# 1.3  Endpoint sentinel sweep - macOS / Linux
grep -rIl -E 'C25061[789]A|C250620A|C26051[12]A|RS260605|9-0135-3' \
  "$(npm root -g)" ~/.npm-global /usr/local/lib/node_modules 2>/dev/null

# 1.4  Endpoint sentinel sweep - Windows PowerShell
Select-String -Path "$env:APPDATA\npm\node_modules\npm\lib\cli.js" `
  -Pattern 'C25061[789]A|C250620A|C26051[12]A|RS260605' -ErrorAction SilentlyContinue

# 1.5  Staging directory check
ls -la ~/.npm/*.zip ~/.npm/*.7z /tmp/.npm 2>/dev/null

Playbook 2 — Workstation remediation (destructive; run only on hosts flagged by playbook 1)

Prerequisites: host isolated in Falcon first; user notified; local admin for application reinstalls; a separate clean machine available for credential rotation. Reboot required: yes — after the application reinstalls, to clear any injected module still resident in memory. Rollback: not applicable in the usual sense, and deliberately so — this playbook removes and reinstalls software rather than reconfiguring it. Preserve evidence before you start (step 2.1); if remediation goes wrong, the recovery path is a full workstation rebuild from your standard image, not a config revert. Do not attempt to restore the injected files.

# 2.1  PRESERVE EVIDENCE FIRST - copy, do not delete
mkdir -p /tmp/ir-evidence
cp "$(npm root -g)/npm/lib/cli.js" /tmp/ir-evidence/ 2>/dev/null
cp -R ~/.npm/_logs /tmp/ir-evidence/ 2>/dev/null
# collect the archive if present, then hand the whole directory to IR out-of-band

# 2.2  Remove the global npm CLI injection by reinstalling npm itself
npm install -g npm@latest
grep -c -E 'C25061[789]A|RS260605' "$(npm root -g)/npm/lib/cli.js"   # expect 0

# 2.3  Reinstall injected desktop applications (do NOT hand-edit the files)
#      VS Code / Cursor / Antigravity, Discord, GitHub Desktop
#      Uninstall, delete the leftover resources directory, reinstall from vendor.

# 2.4  Purge project dependency trees
find ~/src -maxdepth 3 -name node_modules -type d -prune -exec rm -rf {} +
# then, per project:  npm ci

# 2.5  Remove staged exfil archives AFTER evidence collection
rm -f ~/.npm/*.zip ~/.npm/*.7z
rm -rf /tmp/.npm

# 2.6  Reboot, then re-run playbook 1 steps 1.3-1.5 to confirm clean.

Playbook 3 — Registry proxy version denylist

Prerequisites: admin on the internal registry proxy (Artifactory, Nexus, Verdaccio or equivalent); a change window, because a mis-scoped rule can break builds fleet-wide. Reboot required: no — a proxy service reload at most. Rollback: delete the exclude pattern or the policy rule you added and reload the service; builds resume immediately. Capture the current policy export before editing so the revert is a file restore rather than hand-editing.

# 3.1  Export current policy first - this is your rollback artifact
#      (Artifactory)  jf rt curl -XGET /api/repositories/npm-remote > npm-remote.backup.json

# 3.2  Artifactory - exclude pattern on the npm remote repository
#      Repository -> npm-remote -> Advanced -> Exclude Patterns:
**/@joyfill/components/-/components-4.0.0-rc24-2773-beta.*
**/@joyfill/layouts/-/layouts-0.1.2-2773.beta.*

# 3.3  Verdaccio - uplink block via package access rules (config.yaml)
packages:
  '@joyfill/*':
    access: $all
    publish: $authenticated
    proxy: npmjs
    # then enforce the version denylist in your CI policy step:
    #   npm ls --all | grep -E 'joyfill@.*2773' && exit 1

# 3.4  Belt and braces - fail the build if the version ever resolves
#      Add to CI before install:
if grep -qE 'joyfill.*2773' package-lock.json; then
  echo "BLOCKED: compromised Joyfill prerelease in lockfile"; exit 1
fi

# 3.5  Verify:  npm view @joyfill/layouts@0.1.2-2773.beta.0 --registry <your-proxy>
#      should fail to resolve.

Playbook 4 — CI runner egress allowlist

Prerequisites: a non-production runner pool to pilot on; an inventory of every destination your builds legitimately reach (run in audit mode for at least one full build cycle first). Reboot required: no — runners pick the policy up on next job start. Rollback: set the policy back to audit (or remove the egress step from the workflow) and re-run the job; the change is per-workflow configuration and takes effect on the next run with no persistent host state. Keep the audit-mode baseline so you can diff what a re-tightened policy would block.

# 4.1  AUDIT FIRST - one full build cycle, then read the observed destinations.
#      Do not skip this. A default-deny policy applied without a baseline will
#      break builds in ways that look like flaky infrastructure.

# 4.2  Example egress policy shape (adapt to your runner tooling)
egress-policy: block
allowed-endpoints: |
  registry.npmjs.org:443
  github.com:443
  api.github.com:443
  objects.githubusercontent.com:443
  <your-artifact-store>:443

# 4.3  What this stops for THIS campaign, by design:
#      api.trongrid.io, fullnode.mainnet.aptoslabs.com, bsc-dataseed.binance.org,
#      bsc-rpc.publicnode.com, ip-api.com and all four C2 addresses are absent
#      from the allowlist, so stage 1 fails closed and never resolves a payload.

# 4.4  Alerting: treat any BLOCKED egress event from a build as a security event,
#      not a build failure. Route it to the SOC queue, not to the developer.

# 4.5  Verify: run a job that curls a non-allowlisted host; expect a block event.

Eleven CQL queries cover eleven of the seventeen mapped behaviors, four of them at Good confidence with a promotable IOA. Five hard gaps remain and none of them is closable with endpoint telemetry alone: the registry-side compromise, the in-memory stage-1 decode, the Sec-V header, the credential reads themselves, and the Telegram channel. Four of those five are covered by non-CQL controls already in this pack — the lockfile sweep, proxy header logging, IdP/VCS audit review, and CI egress allowlisting. Before deploying, work section 11's four validation gates in order; gate 1's CriticalFileModified test in particular decides whether Q8 is a real detection in your tenant or a documented gap.

Source snapshots for every citation above are preserved verbatim alongside this pack in Joyfill-npm-SupplyChain-Hunt-sources/. Every atomic indicator shipped in section 10 traces back to at least one of those files.