Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Socket.IO RAT : canal C2 persistant via controller.rightwidth[.]dev (HTTPS), détection VM/sandbox, accès shell interactif via child_process.exec() .
16 distinct techniques documented for this family, organized by ATT&CK tactic.
On July 28, 2026, malicious beta versions of two Joyfill npm packages, @joyfill/components and @joyfill/layouts, were published to the npm registry... The packages are legitimate projects that were hijacked, and the malicious code lives only in the published tarballs.
Both versions carry the same heavily obfuscated payload injected into the built distribution bundles... The first stage is a string shuffle decoder... static analysis for literal terms like socket.io or a wallet address finds nothing.
Operators can request host details, steal clipboard content, move files, and run scripts on the victim system.
The resolved stage configures a Socket.IO client to the C2 and registers a command handler with verbs for host info, file upload and download, directory listing, and arbitrary code execution.
Socket.IO RAT : canal C2 persistant via controller.rightwidth[.]dev (HTTPS)
In parallel it spawns a detached node -e child that requests /$/boot from a second host and XOR decrypts the response, so the two stages run independently.
24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan delivered via compromised Joyfill npm package beta releases. It resolves C2 through blockchain transactions, opens a Socket.IO-based remote control channel, supports host reconnaissance, file transfer, directory listing, and arbitrary code execution, and is part of a multi-stage developer workstation compromise.
Remote access trojan component providing persistent command-and-control over HTTPS, VM/sandbox detection, and interactive shell access via child_process.exec().
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.