Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js 两个被篡改的joyfill npm包在导入Node.js时运行RAT

TL;DR

• Two compromised npm packages in the @joyfill namespace contain malicious code that executes a remote access trojan (RAT) when imported into Node.js.
• The malware uses blockchain transactions from Tron, Aptos, and BNB Smart Chain to resolve encrypted payloads, offering operational resilience and dynamic payload updates without republishing.
• The attack is linked to North Korean threat actors via the PolinRider cluster and shares infrastructure with the ViteVenom campaign, indicating coordinated supply chain targeting.
• The implant includes dual execution branches: an in-process JavaScript loader and a detached process that maintains persistence after build/test cycles.
• Affected systems risk credential theft, file exfiltration, clipboard harvesting, and remote command execution across development, CI, and production environments.

Why It Matters

This incident highlights a sophisticated evolution in software supply chain attacks, where adversaries leverage decentralized infrastructure (blockchains) for resilient command-and-control, making detection and takedown significantly harder. For AI practitioners and security teams, it underscores the critical need for rigorous dependency auditing, runtime monitoring of package imports, and zero-trust assumptions around third-party libraries—even those appearing benign or beta-labeled. The use of blockchain-based C2 also signals a shift toward more evasive, self-updating malware that can adapt post-deployment, requiring proactive defense strategies beyond static signature matching.

Technical Details

• Affected Packages: @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4, both published under the same npm identity using Node.js 18.20.0 and npm 10.5.0.
• Malware Delivery Mechanism: Import-time JavaScript implant embedded in CommonJS entry points, triggering execution upon package load—unlike lifecycle-hook-triggered threats.
• Blockchain-Based Payload Resolution: Malware queries Tron, Aptos, and BNB Smart Chain transactions to fetch encrypted payloads; if one chain fails, it falls back to another, ensuring high availability of malicious code.
• Dual Execution Branches:
  • In-process branch retrieves and executes a 77 KB obfuscated "clientCode" RAT via blockchain resolution.
  • Detached branch launches a separate Node.js process contacting IP 23.27.13[.]43 to decrypt and evaluate additional payloads, persisting even after parent process termination.
• Payload Capabilities: The final RAT collects environment data, steals credentials (Windows Credential Manager, browser data, Git secrets), reads clipboard content, uploads files, executes arbitrary commands, and modifies developer tool files—all while avoiding execution on known CI/sandbox hosts (e.g., github-runner, buildbot).
• Associated Malware Families: Linked to DEV#POPPER (RAT), OmniStealer (Python infostealer), and PolinRider/Contagious Interview (North Korean actor cluster).

Industry Insight

Organizations must treat all third-party dependencies as potential threat vectors, especially beta or pre-release versions, and implement strict allowlisting of verified package sources. Security tools should enhance static and dynamic analysis to detect blockchain-resolved payloads and anomalous network behavior during package import. Given the persistence mechanisms and cross-platform data theft capabilities, developers should rotate credentials immediately if affected packages were used, audit lockfiles and caches, and consider air-gapped or sandboxed environments for dependency evaluation before integration. This event reinforces the necessity of software bill of materials (SBOM) tracking and real-time threat intelligence integration within CI/CD pipelines to counter evolving supply chain warfare tactics.

TL;DR

• 两个 @joyfill 命名空间下的 npm 包（@joyfill/layouts 和 @joyfill/components）被植入恶意代码，运行时会触发远程访问木马（RAT）。
• 恶意代码通过 Tron、Aptos 和 BNB Smart Chain 区块链交易解析加密载荷，实现动态更新与隐蔽通信。
• 攻击者使用双分支执行机制：主进程加载 77KB 混淆 payload，后台独立进程从 IP 地址获取额外负载，具备持久化与横向移动能力。
• 该团伙与“PolinRider”威胁集群相关，疑似朝鲜背景，且与近期 ViteVenom 攻击属同一持续运营行动。
• 建议开发者立即移除受影响版本、清理缓存与镜像、锁定可信版本并轮换凭证。

为什么值得看

此事件揭示了开源供应链攻击的新范式——利用多链智能合约作为 C2 基础设施，规避传统黑名单检测，同时结合脱壳、反沙箱与多阶段载荷投递，极大提升隐蔽性与生存能力。对前端工程体系、CI/CD 流程及依赖管理策略构成严峻挑战，亟需强化构建环境安全审计与运行时行为监控。

技术解析

• 攻击载体：@joyfill/layouts@0.1.2-2773.beta.0 与 @joyfill/components@4.0.0-rc24-2773-beta.4 两个 beta/rc 版本在 CommonJS 入口点即触发植入逻辑，非依赖 npm lifecycle hook，更难被静态扫描发现。
• 区块链 C2 机制：硬编码 Tron 地址查询最新 outbound tx hash → fallback 至 Aptos 账户 → 提取 BSC 交易数据解密 payload；三链冗余设计增强抗封锁能力，支持无版本更新切换恶意内容。
• 双通道执行架构：
  • In-process branch: 加载 77KB 混淆 JS 作为二级 loader，最终解码出名为 "clientCode" 的 RAT；
  • Detached branch: 启动独立 Node.js 子进程连接 23.27.13[.]43 获取 boot payload，即使原进程退出仍可持续运行。
• payload 功能集：收集主机信息、窃取浏览器/Credential Manager/GitHub CLI/VS Code 等敏感数据、剪贴板监听、文件上传、Socket.IO 远程控制、命令注入、绕过 dev/CI/sandbox 环境（识别 github-runner, buildbot 等 hostname）。
• 关联威胁情报：同一家族 OmniStealer Python infostealer 出现在 detached branch 中；整体操作归因于 PolinRider / Contagious Interview，确认为朝鲜国家支持组织长期 campaign 的一部分。

行业启示

• 软件供应链信任模型重构必要：依赖包来源验证不足 + 动态载荷解析 = 高风险组合；应推行 SBOM + 签名校验 + 构建时完整性检查三重防线。
• 区块链用于恶意分发已成现实趋势：去中心化存储不可篡改特性被滥用为“免杀+C2”，安全工具需新增对链上交易哈希、钱包地址行为的异常检测规则。
• 开发环境与生产环境隔离失效风险加剧：恶意代码专门避开 CI/Runner/Sandbox 说明攻击者高度关注渗透路径选择，必须对所有中间件环节实施最小权限原则与网络出口控制。