Two @joyfill npm packages compromised: RAT fires the moment you import them

Socket, a company that specializes in software supply chain security, has reported the compromise of two packages from the @joyfill namespace in the npm registry. The infected artifacts turned out to be the beta builds @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4. Inside is a remote access trojan from the DEV#POPPER family.

Triggered on import, not by a hook

The malware's key feature is when it runs. Most packages like this activate through npm lifecycle hooks at install time. Here, though, the implant executes the moment Node.js loads the CommonJS package's entry point. In other words, simply pulling the library into your code is enough — and it gains the ability to run arbitrary commands in the context of any process: a development environment, a CI runner, a test environment, server-side rendering or a build.

Blockchain instead of the usual C2

The most intriguing part is how the payload is delivered. The encrypted code is fetched through transactions on the Tron, Aptos and BNB Smart Chain networks. The implant reaches out to a “hardcoded” Tron address, extracts a BSC transaction hash, and if that step fails, uses an Aptos account as a fallback path. JavaScript is extracted from the transaction and decrypted.

This multi-layered scheme gives the attackers resilience: the payload can be changed without publishing a new version of the package. The same tactic was spotted earlier in the ViteVenom campaign against the Vite ecosystem, and Socket ties both cases to a single operation by North Korean groups (the PolinRider and Contagious Interview clusters).

What the malware does

The implant runs in two parallel branches. One reconstructs a 77-kilobyte clientCode payload — a Node.js RAT with remote control via Socket.IO. The other spawns a separate Node.js process that reaches out to the IP address 23.27.13[.]43 for a bootstrap payload. This branch is not tied to the original process and keeps running even after the build or CLI command finishes.

The final clientCode can exfiltrate files, gather information about the host, read the clipboard (via PowerShell on Windows, pbpaste on macOS, xclip/xsel on Linux) and load additional code. At the same time, it avoids running on machines named github-runner, buildbot, buildkitsandbox and microsoft-standard-WSL2 — that is, in CI and sandboxes. Tied to the second branch is also a Python infostealer (assessed to be a variant of OmniStealer) that steals data from browsers, wallets, password managers, Git credentials, the GitHub CLI configuration and the VS Code storage.

What to do

Both malicious versions were published from a single npm account using Node.js 18.20.0 and npm 10.5.0; the code was already present at the build stage. Exactly how the injection happened — through a compromised workstation, repository, CI or publishing credentials — is not yet clear.

Developers who installed the infected versions are advised to remove them from lockfiles, caches, internal mirrors, build images and deployment artifacts, pin to a verified version and rotate all credentials that were accessible to the compromised process.

Source: The Hacker News