Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js
Summary: Beta versions of two npm packages in the @joyfill namespace were compromised to deliver a remote access trojan tied to the DEV#POPPER malware family, with an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions. The implant runs when Node.js loads the CommonJS package entry point rather than through an npm lifecycle hook, and its final "clientCode" payload is an obfuscated Node.js RAT that avoids execution on hosts named github-runner, buildbot, buildkitsandbox, and microsoft-standard-WSL2.
What's compelling: Socket attributes both this collection and the earlier ViteVenom packages to the same North Korean operation, and the blockchain resolver lets the operators swap payloads without publishing a new package version. A detached branch keeps running after a build, test, or CLI command exits, so a clean pipeline log does not mean the host is clean.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026