Beta release versions of two npm packages, `@joyfill/[email protected]` and `@joyfill/[email protected]`, have been identified as compromised. These packages are delivering a remote access trojan (RAT) associated with the **DEV#POPPER** malware family. ### Sophisticated Infection Mechanism According to an analysis by **Socket**, the compromised packages contain an import-time JavaScript implant. This implant resolves encrypted code through transactions on **Tron**, **Aptos**, and **BNB Smart Chain (BSC)**. Unlike many malicious packages that rely on npm lifecycle hooks, this implant activates when **Node.js** loads the CommonJS package entry point, making it particularly stealthy. ### Links to North Korean Threat Actors This multi-blockchain resolver structure has been previously connected to **PolinRider**, a threat cluster believed to be related to **Contagious Interview**. Earlier this month, **Checkmarx** and **OpenSourceMalware** also highlighted a similar set of malicious npm packages, dubbed **ViteVenom**, targeting the **Vite** frontend tooling ecosystem. **ViteVenom** utilized the same tiered blockchain-based command-and-control (C2) infrastructure to deliver a RAT with capabilities for reverse shells, credential harvesting, file exfiltration, and persistent backdoor injection. ### Dual-Branch Payload Delivery The implant operates through two parallel sequences of actions: * **In-process Branch**: This path leads to a recovered 77 KB JavaScript payload, showing similarities to the **DEV#POPPER** malware family. * **Secondary Detached Branch**: This branch launches a separate **Node.js** process, requests a distinct boot payload from the IP address `23.27.13[.]43`, decrypts the response, and then executes it. Upon package loading, a blockchain-based dispatch is initiated. It obtains a **BSC** transaction hash from the latest outbound transaction of a hard-coded **Tron** address. If this fails, it queries an **Aptos** account as a fallback to fetch the **BSC** transaction, from which it decrypts and executes JavaScript code. Both branches utilize distinct sets of wallet addresses, accounts, and transactions across **Tron**, **Aptos**, and **BSC**. This blockchain integration provides operational resilience, allowing threat actors to switch payloads without needing to publish new package versions. ### The Final Payload: A Potent RAT and Infostealer The first in-process payload is a JavaScript loader that uses blockchain resolution to retrieve a second-stage malware named "clientCode." The detached process, however, directly queries the aforementioned IP address for its JavaScript code. **Socket** emphasizes that the detached branch is a redundant delivery mechanism, not a harmless fallback. It can persist even after a build, test, or CLI command exits, ensuring continued compromise. The heavily obfuscated "clientCode" payload functions as a **Node.js** RAT with extensive capabilities, while evading execution on development, CI, or sandboxed machines (e.g., those with hostnames like `github-runner`, `buildbot`, `buildkitsandbox`, and `microsoft-standard-WSL2`). Its features include: * File uploads to a configured host. * Retrieval of additional JavaScript. * Collection of basic host details. * Sending status check-in messages. * Reading clipboard data across Windows (via **PowerShell**), macOS (via `pbpaste`), and Linux (via `xclip` or `xsel`). Associated with the detached process are two payloads: the "clientCode" RAT and a **Python** infostealer. The infostealer, assessed to be an iteration of the **OmniStealer** malware (first detailed by **eSentire** in April), can harvest a wide range of sensitive data: * Environment and host information. * **Windows Credential Manager** and **Linux Secret Service** data. * **Chromium** and **Firefox** browser data. * Browser extension storage for wallets and password managers. * **Git** credentials. * **GitHub CLI** configuration. * **GitHub Desktop** logs. * **Microsoft Visual Studio Code** storage. ### Coordinated Attack by North Korean Actors **Socket** has confirmed that both **ViteVenom** and the latest npm package compromises are part of the same ongoing operation by North Korean threat actors, rather than separate campaigns. Both malicious versions were published by the same npm identity using **Node.js 18.20.0** and **npm 10.5.0**, with the malicious code present at bundle time. The exact method of source code injection – whether via a compromised developer workstation, source repository, CI environment, or publishing credentials – remains under investigation. ### Recommendations for Developers Developers who have installed the affected versions are strongly advised to: * Remove them from lockfiles, caches, internal mirrors, build images, and deployment artifacts. * Pin to a verified, safe version. * Rotate credentials from any affected **Node.js** process. **Socket** warns that the `@joyfill/layouts` release should be considered capable of arbitrary code execution within any process that loads it, including development environments, CI runners, test tooling, server-side rendering, and builds. The final recovered code can collect host information, establish a **Socket.IO** remote-control channel, execute JavaScript or shell commands, upload files, read clipboard data, and modify developer tool files.