🧰 @joyfill/layouts

The items that name it 2

• Socket: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
  writeup2026-09-20

  npm package managing page and field layouts for Joyfill forms/documents/PDFs; compromised beta release containing the import-time implant.

• Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan
  writeup2026-07-30

  npm package; malicious code spliced into dist/index.cjs.js and dist/index.es.js