The break is at import time. A package load can now be the trigger that hands control to a Node.js RAT, so the standard assumption that beta risk is mostly an install-time problem misses the real exposure.
Two @joyfill beta packages in a trusted npm namespace were reported backdoored: @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4. The implant runs when Node.js loads the CommonJS entry point and uses Tron, Aptos, and BNB Smart Chain transactions to fetch encrypted code, which makes the payload harder to block or take down by shutting off one server.
That means build runners, developer workstations, and artifacts touched during testing can stay exposed even if the package is no longer present. Using blockchain-based resolution also changes the cleanup problem: the delivery path can shift without republishing the package.