Security firm Socket found that two Joyfill npm packages were compromised to deliver a remote access trojan that harvests browser data, crypto wallets, and Git and GitHub CLI credentials from developer machines. The malware resolves its command-and-control by chaining transactions across three separate blockchain networks, with a backup path to a hardcoded IP if that fails, letting the operators swap out their real infrastructure any time without ever republishing the malicious package.
Socket posted a write up about this here: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POP…
Roman Sannikov, Global Research Coordinator, iCOUNTER
“The part of this that actually got my attention is the command-and-control setup. Chaining together transactions across three separate blockchain networks, with a fallback process that pulls a boot payload straight from a hardcoded IP if the primary chain fails, gives the operators a way to swap out their real payload infrastructure any time they want, without ever having to touch the npm package again. Persistence is really the whole game for a threat actor once they’re in, and this is one of the more ingenious ways I’ve seen someone build that in from day one. The credential harvesting tells the same story. Browser data, crypto wallet extensions, Git and GitHub CLI credentials, VS Code storage, basically anything a developer machine touches, that breadth isn’t what you build if you’re just trying to grab a batch of credentials to sell quickly. It’s what you build if you’re planning to operate inside these environments for a while. What I’d flag for defenders is that Socket still hasn’t nailed down how the packages got compromised in the first place, workstation, repo, CI pipeline, or stolen publishing credentials are all still open questions, and that answer is going to matter more than the malware itself, because it tells you where the next one comes from.”
Besides nailing down how these packages got compromised is an important step. But as a matter of course, software vendors of all sorts need to know what’s in their software and where it came from as well as be accountable for that by a third party. That is when we will see real change.
Related
This entry was posted on July 29, 2026 at 1:29 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Compromised npm packages are using blockchain transactions to hide their command-and-control
Security firm Socket found that two Joyfill npm packages were compromised to deliver a remote access trojan that harvests browser data, crypto wallets, and Git and GitHub CLI credentials from developer machines. The malware resolves its command-and-control by chaining transactions across three separate blockchain networks, with a backup path to a hardcoded IP if that fails, letting the operators swap out their real infrastructure any time without ever republishing the malicious package.
Socket posted a write up about this here: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POP…
Roman Sannikov, Global Research Coordinator, iCOUNTER
“The part of this that actually got my attention is the command-and-control setup. Chaining together transactions across three separate blockchain networks, with a fallback process that pulls a boot payload straight from a hardcoded IP if the primary chain fails, gives the operators a way to swap out their real payload infrastructure any time they want, without ever having to touch the npm package again. Persistence is really the whole game for a threat actor once they’re in, and this is one of the more ingenious ways I’ve seen someone build that in from day one. The credential harvesting tells the same story. Browser data, crypto wallet extensions, Git and GitHub CLI credentials, VS Code storage, basically anything a developer machine touches, that breadth isn’t what you build if you’re just trying to grab a batch of credentials to sell quickly. It’s what you build if you’re planning to operate inside these environments for a while. What I’d flag for defenders is that Socket still hasn’t nailed down how the packages got compromised in the first place, workstation, repo, CI pipeline, or stolen publishing credentials are all still open questions, and that answer is going to matter more than the malware itself, because it tells you where the next one comes from.”
Besides nailing down how these packages got compromised is an important step. But as a matter of course, software vendors of all sorts need to know what’s in their software and where it came from as well as be accountable for that by a third party. That is when we will see real change.
Share this:
Like this:
Related
This entry was posted on July 29, 2026 at 1:29 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.