Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan (RAT) associated with theDEV#POPPERmalware family.

The list of affected packages is as follows -

The two packages "contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions," Socketsaidin an analysis.

Unlike other malicious packages that are triggered via an npm lifecycle hook, the implant delivered as part of the JavaScript libraries runs when Node.js loads the CommonJS package entry point.

It's worth noting that the use of a multi-blockchain resolver structure comprising Tron, Aptos, and BNB Smart Chain (BSC) has been linked to a threat cluster tracked asPolinRider, which is assessed to be related toContagious Interview.

Earlier this month, Checkmarx and OpenSourceMalwarehighlighteda set of malicious npm packages collectively referred to as ViteVenom targeting the Vite frontend tooling ecosystem using the same tiered blockchain-based command-and-control (C2) infrastructure to deliver a RAT with reverse shell, credential harvesting, file exfiltration, and persistent backdoor injection capabilities.

The implant consists of two parallel sequences of actions -

Once the package is loaded, it initiates a blockchain-based dispatch that obtains a BSC transaction hash from the latest outbound transaction of a hard-coded Tron address. If this step fails, it queries an Aptos account as a fallback to fetch the BSC transaction and, from it, decrypt and extract the JavaScript code and execute it.

Both the in-process and detached branches use a distinct set of wallet addresses, accounts, and transactions for Tron, Aptos, and BSC. The use of blockchain also means that it offers operational resilience and makes it possible to switch payloads without having to publish a new version of the packages.

The first in-process payload is a JavaScript loader that employs the blockchain resolution method to retrieve a second-stage malware named "clientCode." The detached process, on the other hand, queries the aforementioned IP address to obtain and execute JavaScript code.

"This is a redundant delivery branch, not a harmless fallback," Socket explained. "It is detached from the importing Node.js process and can continue after a build, test, or CLI command exits."

The final "clientCode" payload is heavily obfuscated and functions as a Node.js RAT with the following features, while avoiding execution on development, CI, or sandboxed machines with the hostnames github-runner, buildbot, buildkitsandbox, and microsoft-standard-WSL2 -

Two payloads have been associated with the detached process: the "clientCode" RAT and a Python infostealer that can harvest a wide range of data from compromised hosts. It's assessed to be an iteration of the OmniStealer malware, details of which werefirst highlightedby eSentire earlier this April.

The data collected by the malware is below -

Socket told The Hacker News that both ViteVenom and the latest collection of npm packages are connected to the same ongoing operation by North Korean threat actors, rather than representing separate campaigns.

According to the application security company, both malicious versions are said to have been published by the same npm identity using Node.js 18.20.0 and npm 10.5.0, with the code present at bundle time. That said, it's currently not clear if this source code injection was achieved following a compromise of a developer workstation, source repository, CI environment, or publishing credentials.

Developers who have installed the affected versions are advised to remove them from lockfiles, caches, internal mirrors, build images, and deployment artifacts, pin to a verified version, and rotate credentials from the affected Node.js process.

"The @joyfill/layouts release should be treated as capable of arbitrary code execution in the context of any process that loads it," Socket said. "This includes development environments, CI runners, test tooling, server-side rendering, and builds."

"The final recovered code can collect host information, establish a Socket.IO remote-control channel, execute supplied JavaScript or shell commands, upload files, read clipboard data, and modify files belonging to developer tools."

Cybersecurity Webinars

How to Secure AI Code Before It Reaches Production

Learn how 300 enterprise leaders are managing AI-driven open-source risk, remediation debt, and governance at scale.

How to Secure AI-Built Software at Machine Speed

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

A Look Inside Lasso's AI Security Platform

Claude Runs Across Six Surfaces in Your Company. Your Security Team Sees One.

How to Make Social Engineering Unprofitable

The New Insider Has No Pulse: Securing Privilege When the Actor Is an AI Agent

Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free.