Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan

Malicious beta versions of the @joyfill/components and @joyfill/layouts npm packages delivered a highly obfuscated, multi-stage remote access trojan and credential stealer that activates on import, hijacks developer environments, and spreads via supply chain, making immediate remediation and credential rotation critical for affected users.