@joyfill/components and @joyfill/layouts beta releases on npm were published with obfuscated malicious code in the distributed bundles that is not present in the project source. On import the code resolves command-and-control endpoints from Tron and Binance Smart Chain transactions, opens a Socket.IO remote-access channel supporting file upload/download, shell command execution and clipboard capture, deploys a Python credential stealer targeting browser data, cryptocurrency wallet extensions, Git credentials and OS keychains, and establishes persistence by modifying developer tool files (VS Code, Discord, GitHub Desktop, npm CLI).