Full Report
Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan (RAT) associated with the DEV#POPPER malware family. The list of affected packages is as follows - @joyfill/[email protected] @joyfill/[email protected] The two packages "contain an import-time JavaScript implant that resolves encrypted code
Analysis Summary
# Incident Report: Compromised @joyfill npm Packages (DEV#POPPER RAT)
## Executive Summary
Two beta versions of the `@joyfill` npm namespace packages were compromised to deliver a multi-stage Remote Access Trojan (RAT) and an information stealer. The attack utilized a sophisticated blockchain-based command-and-control (C2) resolver mechanism to bypass traditional detection. The incident is attributed to North Korean threat actors (connected to PolinRider/DEV#POPPER clusters) targeting developer environments.
## Incident Details
- **Discovery Date**: July 29, 2026 (Reported)
- **Incident Date**: July 2026
- **Affected Organization**: Joyfill (npm namespace `@joyfill`)
- **Sector**: Software Development / Technology
- **Geography**: Global (npm ecosystem)
## Timeline of Events
### Initial Access
- **Date/Time**: July 2026
- **Vector**: Supply Chain Compromise
- **Details**: Attackers gained unauthorized access to the `@joyfill` npm namespace and published two malicious beta releases: `@joyfill/[email protected]` and `@joyfill/[email protected]`.
### Execution & Lateral Movement
- **Execution**: The malware is triggered at "import-time." Unlike typical npm malware using lifecycle hooks (e.g., `preinstall`), this runs when Node.js loads the CommonJS entry point.
- **Persistence**: A detached Node.js process is spawned. This process survives even after the primary build, test, or CLI command finishes, allowing for long-term presence on the developer's machine.
### Data Exfiltration/Impact
- **Data Stolen**: Harvested credentials from Windows Credential Manager, Linux Secret Service, browser data (Chrome/Firefox), crypto wallet extensions, Git credentials, and VS Code storage.
- **Impact**: Full compromise of developer workstations and potential downstream access to GitHub repositories and cloud infrastructure via stolen CLI tokens.
### Detection & Response
- **Detection**: Identified by Socket security researchers through behavioral analysis of npm package imports.
- **Response Actions**: Analysis of the tiered blockchain infrastructure and public disclosure to warn the developer community.
## Attack Methodology
- **Initial Access**: Dependency poisoning/Account takeover of the `@joyfill` npm namespace.
- **Persistence**: Detached Node.js processes and persistent backdoor injection.
- **Defense Evasion**:
- Obfuscated "clientCode" payload.
- Blockchain-based C2 resolution (harder to sinkhole).
- Hostname blacklisting: Avoids execution on `github-runner`, `buildbot`, `buildkitsandbox`, and `WSL2` to evade CI/CD sandboxes and researchers.
- **Credential Access**: Targeting Windows Vault, Linux Keyrings, and browser-stored credentials.
- **Discovery**: Collection of host details and environment variables.
- **Collection**: Clipboard monitoring (via PowerShell/pbpaste/xclip) and file harvesting.
- **Exfiltration**: Tiered C2 architecture using Tron, Aptos, and BNB Smart Chain transactions to resolve the final payload delivery IPs.
## Impact Assessment
- **Financial**: High risk of cryptocurrency theft via browser extension harvesting.
- **Data Breach**: Sensitive developer credentials, Git tokens, and local source code storage.
- **Operational**: Compromised integrity of the `@joyfill` library, requiring cleanup for all users who pulled the beta versions.
- **Reputational**: Significant impact on the trust of the `@joyfill` npm namespace.
## Indicators of Compromise
- **Network Indicators**:
- `23.27.13[.]43` (Payload delivery)
- Transactions on Tron, Aptos, and BNB Smart Chain (resolvers)
- **File Indicators**:
- `@joyfill/[email protected]`
- `@joyfill/[email protected]`
- **Behavioral Indicators**:
- Node.js attempting to spawn a detached child process during a package import.
- Unexpected outbound connections to blockchain API endpoints from developer machines.
## Response Actions
- **Containment**: Removal of the malicious beta versions from the npm registry (coordinated with npm/GitHub).
- **Eradication**: Developers must audit `package-lock.json` files for the affected versions and rotate all secrets managed on compromised machines.
- **Recovery**: Reverting to known-good stable versions of the `@joyfill` libraries.
## Lessons Learned
- **Import-Time Risks**: Security audits must move beyond lifecycle scripts (`postinstall`) to scrutinize the actual logic executed during a library `import`.
- **Blockchain C2**: Attackers are increasingly using decentralized ledgers for C2 resilience, making IP-based blocking less effective.
- **Sandbox Evasion**: The malware specifically checks for CI/CD hostnames, suggesting a need for more diverse or stealthy analysis environments.
## Recommendations
1. **Pin Dependencies**: Use exact versions or hashes for internal dependencies; avoid broad beta/rc ranges.
2. **Behavioral Monitoring**: Monitor developer workstations for anomalous PowerShell or Node.js network activity.
3. **Secret Hygiene**: Use short-lived credentials for GitHub and AWS CLI to minimize the window of opportunity for infostealers.
4. **Supply Chain Tooling**: Implement tools like Socket or Snyk that flag "import-time" code execution and unusual package behaviors.