Malicious prerelease builds of `@joyfill/components` and `@joyfill/layouts` executed an obfuscated Node.js loader when imported, bypassing protections focused on npm installation scripts. The implant used blockchain transactions to resolve later stages, deployed a Socket.IO remote-access trojan, injected persistence into developer tools and the global npm CLI, and staged a Python credential stealer. StepSecurity identified six affected versions and advised treating any environment that imported them as compromised, removing the packages, inspecting persistence targets, and rotating exposed credentials.