🚨 Two Joyfill npm beta releases were compromised with an import-time implant that resolves encrypted payloads through Tron, Aptos, and BNB Smart Chain transactions to load a Node.js RAT: • @joyfill/layouts@0.1.2-2773.beta.0 • @joyfill/components@4.0.0-rc24-2773-beta.4 The RAT can execute JavaScript and shell commands, upload files, collect clipboard data, and persist through VS Code, Cursor, GitHub Desktop, and npm CLI files. Full analysis: https://socket.dev/blog/joyfill-npm-beta-releases-compromised