Two malicious beta releases in the legitimate `@joyfill` npm scope executed an obfuscated loader when applications imported their production bundles. The loader resolved encrypted payloads through two successive Tron-to-BSC transaction chains, selected C2 infrastructure according to a campaign marker, and ultimately delivered a compressed RAT client. SafeDep found that the blockchain infrastructure and stage 3 bot fingerprints matched its earlier `astro.config.mjs` and PolinRider analysis, although the article did not explicitly state a DPRK attribution. The packages were unpublished after roughly ten hours but remained available through some registry mirrors.