Compromised joyfill npm Packages Deliver Remote‑Access Trojan via Import in Node.js

Two beta versions of npm packages from the @joyfill namespace – @joyfill/layouts 0.1.2‑2773.beta.0 and @joyfill/components 4.0.0‑rc24‑2773‑beta.4 – have been compromised. The malicious code is embedded in the CommonJS entry point and activates as soon as the package is imported, bypassing typical npm lifecycle‑hook defenses and the --ignore-scripts option.

The implant retrieves encrypted payloads through a multi‑step resolver that queries transactions on the Tron, Aptos and BNB Smart Chain blockchains. One branch loads a ~77 KB JavaScript payload resembling the DEV#POPPER malware family; a second branch spawns an independent Node.js process that fetches additional code from the IP address 23.27.13.43, decrypts it and executes it. The combined payload functions as a remote‑access trojan (RAT) giving attackers control over the compromised host.

Security firm Socket links the activity to the PolinRider threat cluster, which it believes is part of a broader, likely North‑Korean operation also associated with the earlier ViteVenom campaign. Developers are advised to remove the affected packages, pin to verified versions, and rotate any credentials that may have been exposed.