Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js
Two compromised npm packages in the @joyfill namespace contain malicious code that executes a remote access trojan (RAT) when imported into Node.js. The malware uses blockchain transactions from Tron, Aptos, and BNB Smart Chain to resolve encrypted payloads, offering operational resilience and dynamic payload updates without republishing. The attack is linked to North Korean threat actors via the PolinRider cluster and shares infrastructure with the ViteVenom campaign, indicating coordinated sup
Analysis
TL;DR
- Two compromised npm packages in the @joyfill namespace contain malicious code that executes a remote access trojan (RAT) when imported into Node.js.
- The malware uses blockchain transactions from Tron, Aptos, and BNB Smart Chain to resolve encrypted payloads, offering operational resilience and dynamic payload updates without republishing.
- The attack is linked to North Korean threat actors via the PolinRider cluster and shares infrastructure with the ViteVenom campaign, indicating coordinated supply chain targeting.
- The implant includes dual execution branches: an in-process JavaScript loader and a detached process that maintains persistence after build/test cycles.
- Affected systems risk credential theft, file exfiltration, clipboard harvesting, and remote command execution across development, CI, and production environments.
Why It Matters
This incident highlights a sophisticated evolution in software supply chain attacks, where adversaries leverage decentralized infrastructure (blockchains) for resilient command-and-control, making detection and takedown significantly harder. For AI practitioners and security teams, it underscores the critical need for rigorous dependency auditing, runtime monitoring of package imports, and zero-trust assumptions around third-party libraries—even those appearing benign or beta-labeled. The use of blockchain-based C2 also signals a shift toward more evasive, self-updating malware that can adapt post-deployment, requiring proactive defense strategies beyond static signature matching.
Technical Details
- Affected Packages:
@joyfill/layouts@0.1.2-2773.beta.0and@joyfill/components@4.0.0-rc24-2773-beta.4, both published under the same npm identity using Node.js 18.20.0 and npm 10.5.0. - Malware Delivery Mechanism: Import-time JavaScript implant embedded in CommonJS entry points, triggering execution upon package load—unlike lifecycle-hook-triggered threats.
- Blockchain-Based Payload Resolution: Malware queries Tron, Aptos, and BNB Smart Chain transactions to fetch encrypted payloads; if one chain fails, it falls back to another, ensuring high availability of malicious code.
- Dual Execution Branches:
- In-process branch retrieves and executes a 77 KB obfuscated "clientCode" RAT via blockchain resolution.
- Detached branch launches a separate Node.js process contacting IP 23.27.13[.]43 to decrypt and evaluate additional payloads, persisting even after parent process termination.
- Payload Capabilities: The final RAT collects environment data, steals credentials (Windows Credential Manager, browser data, Git secrets), reads clipboard content, uploads files, executes arbitrary commands, and modifies developer tool files—all while avoiding execution on known CI/sandbox hosts (e.g., github-runner, buildbot).
- Associated Malware Families: Linked to DEV#POPPER (RAT), OmniStealer (Python infostealer), and PolinRider/Contagious Interview (North Korean actor cluster).
Industry Insight
Organizations must treat all third-party dependencies as potential threat vectors, especially beta or pre-release versions, and implement strict allowlisting of verified package sources. Security tools should enhance static and dynamic analysis to detect blockchain-resolved payloads and anomalous network behavior during package import. Given the persistence mechanisms and cross-platform data theft capabilities, developers should rotate credentials immediately if affected packages were used, audit lockfiles and caches, and consider air-gapped or sandboxed environments for dependency evaluation before integration. This event reinforces the necessity of software bill of materials (SBOM) tracking and real-time threat intelligence integration within CI/CD pipelines to counter evolving supply chain warfare tactics.
Disclaimer: The above content is generated by AI and is for reference only.