Compromised joyfill npm Packages Run DEV#POPPER RAT on Node.js Import

Two beta versions of npm packages in the @joyfill namespace—@joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4—have been compromised to deliver a remote access trojan (RAT) from the DEV#POPPER malware family, according to Socket's analysis. Unlike typical supply chain attacks that exploit npm lifecycle hooks, these packages embed an import-time JavaScript implant that fires the moment Node.js loads the CommonJS entry point, making the malicious behavior nearly invisible during routine installation.

The implant resolves its next-stage payload through encrypted transactions on three blockchains—Tron, Aptos, and BNB Smart Chain (BSC)—a multi-chain C2 pattern that Socket links to the threat cluster PolinRider and, by extension, the Contagious Interview North Korean campaign. The same blockchain-based infrastructure was recently documented by Checkmarx and OpenSourceMalware in the ViteVenom campaign targeting Vite.js tooling. Once a package is imported, the loader fetches the latest outbound transaction from a hardcoded Tron address to obtain a BSC transaction hash, decrypts the embedded JavaScript, and executes it. If the Tron query fails, it falls back to an Aptos account.

The payload splits into two parallel execution paths. The first is an in-process branch that decrypts and runs a 77 KB JavaScript loader to fetch a second-stage malware called "clientCode." The second is a detached Node.js process that requests a separate boot payload from the IP address 23.27.13[.]43—researchers can investigate such endpoints with a WHOIS lookup or probe them with a port scanner—then decrypts and evaluates the response. Socket emphasized that the detached branch is not a benign fallback but a redundant delivery mechanism that survives after build, test, or CLI commands terminate. The final clientCode payload is heavily obfuscated and operates as a full Node.js RAT capable of reverse shells, credential harvesting, file exfiltration, and persistent backdoor injection, while skipping execution on hosts named github-runner, buildbot, or buildkitsandbox to evade analysis.

Because the C2 logic lives on public blockchains, operators can rotate payloads without publishing new package versions—giving the threat actor long-term operational resilience inside any project that pulled the affected beta builds. Developers are urged to audit their lockfiles, pin package versions, and remove the two compromised releases immediately. For broader supply chain hygiene, running a privacy checkup on development environments can help surface unexpected outbound connections to suspicious infrastructure.