Malicious Package Affecting @joyfill/layouts package, versions =0.1.2-2773.beta.0=0.1.2-2773.beta.1=0.1.2-2773.beta.2
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-JOYFILLLAYOUTS-18385348
- published29 Jul 2026
- disclosed28 Jul 2026
- creditUnknown
Introduced: 28 Jul 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the @joyfill/layouts package.
Overview
@joyfill/layouts is a malicious package. This package contains a supply chain compromise that executes a malicious payload immediately upon import of the vulnerable versions. When loaded, the package uses decentralized blockchain resolvers (Tron, Aptos, BNB Smart Chain) to fetch and execute an obfuscated Remote Access Trojan (RAT) and an infostealer. It establishes persistent remote control, spawns detached background processes to survive build termination, and steals browser data, crypto wallet extensions, VS Code storage, and Git/GitHub credentials.