{
    "type": "bundle",
    "id": "bundle--5019ffe8-f411-43c4-8e77-acd363d99597",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--856c3fc6-486a-43be-9478-5ac6814df5a3",
            "created": "2026-03-31T08:31:49.722408Z",
            "modified": "2026-03-31T08:35:18.517396Z",
            "name": "StepSecurity",
            "identity_class": "organization"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--58eae032-cb85-4636-885a-e48bf57667d1",
            "value": "166.88.134.62"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--c536dec4-c5ed-4410-9b70-ab9994e7b461",
            "value": "198.105.127.210"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--07b2a6fc-8fc9-4ac8-9a19-ae97064c246f",
            "value": "23.27.202.27"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--dc024e0c-beba-4a98-97b1-2e6b55a33e61",
            "hashes": {
                "SHA-256": "36ff00b45e67baa7e3674b0c80f48e88737264c61e5c6b3b091200972de8157c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1c5e4ade-6902-48ff-af5d-07b9eabdeea1",
            "hashes": {
                "SHA-256": "26351aed0397158d3a3b8cc8fd3047d4c015d264c9895f10f20f1521b974ed18"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--3c8c1936-b8e7-4306-a77a-c6e0ba731f26",
            "value": "23.27.13.43"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--126fe65e-96e8-41ab-ba7a-e8e8af220ff0",
            "created_by_ref": "identity--856c3fc6-486a-43be-9478-5ac6814df5a3",
            "created": "2026-07-29T11:10:38.592625Z",
            "modified": "2026-07-29T11:10:38.592625Z",
            "name": "Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan",
            "published": "2026-07-28T00:00:00Z",
            "object_refs": [
                "identity--856c3fc6-486a-43be-9478-5ac6814df5a3",
                "ipv4-addr--58eae032-cb85-4636-885a-e48bf57667d1",
                "ipv4-addr--c536dec4-c5ed-4410-9b70-ab9994e7b461",
                "ipv4-addr--07b2a6fc-8fc9-4ac8-9a19-ae97064c246f",
                "file--dc024e0c-beba-4a98-97b1-2e6b55a33e61",
                "file--1c5e4ade-6902-48ff-af5d-07b9eabdeea1",
                "ipv4-addr--3c8c1936-b8e7-4306-a77a-c6e0ba731f26"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.stepsecurity.io/blog/joyfill-npm-supply-chain-compromise"
                }
            ]
        }
    ]
}