Two Compromised joyfill npm Packages Deliver RAT via Blockchain-Based C2

Two npm packages in the @joyfill namespace, @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4, have been compromised to deliver a remote access trojan (RAT) associated with the DEV#POPPER malware family. The malicious code runs when Node.js loads the CommonJS package entry point, using a multi-blockchain resolver structure involving Tron, Aptos, and BNB Smart Chain (BSC) to fetch encrypted payloads. This technique has been linked to the PolinRider threat cluster, related to the Contagious Interview campaign.

The implant executes two parallel sequences: an in-process branch that recovers a 77 KB JavaScript payload similar to DEV#POPPER, and a secondary branch that launches a detached Node.js process to fetch a boot payload from IP 23.27.13.43. The final payload, named “clientCode,” is a heavily obfuscated Node.js RAT capable of uploading files, retrieving additional JavaScript, collecting host details, sending status check-ins, and reading clipboard data via PowerShell (Windows), pbpaste (macOS), or xclip/xsel (Linux). It avoids execution on machines with hostnames like github-runner, buildbot, buildkitsandbox, and microsoft-standard-WSL2.

Socket, the application security company that analyzed the attack, confirmed that both ViteVenom and these joyfill packages are part of the same ongoing operation by North Korean threat actors. The malicious versions were published by the same npm identity using Node.js 18.20.0 and npm 10.5.0. Developers who installed the affected versions should remove them from lockfiles, caches, internal mirrors, build images, and deployment artifacts, pin to a verified version, and rotate credentials from the affected Node.js process.