Import-time execution

Named by 2 kept items in this workspace.

Search every workspace for Import-time execution. It matches the name as written, so it can find other things that share it.

The items that name it 2

Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan
writeup2026-07-30It is written here as Import-time execution (not postinstall).
Malicious code executes when the package is imported (test, bundler run, dev server, or production deploy), not via a postinstall script, so npm install --ignore-scripts does not stop it
JFrog: npm v12
article2026-06-18It is written here as Import Time Execution.
Malicious code executes as soon as a package is imported, without any function call needed

All techniques in this workspace.