Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

The integrity of the modern software supply chain remains under persistent siege as threat actors continue to exploit the trust placed in open-source package repositories. A recent discovery within the Node.js ecosystem serves as a stark reminder of this vulnerability, specifically regarding two compromised npm packages. Security analysts have identified that beta versions of libraries within the @joyfill namespace were weaponized to deliver a remote access trojan, marking a sophisticated escalation in supply chain attack vectors.

The incident specifically involves the packages @joyfill/layouts and @joyfill/components. The affected versions, identified as 0.1.2-2773.beta.0 and 4.0.0-rc24-2773-beta.4 respectively, were not merely corrupted but actively malicious. These compromised builds contain a JavaScript implant engineered to trigger the moment the package is imported into a Node.js environment. Upon execution, the malicious code resolves and decrypts a hidden payload, ultimately infecting the host system with a remote access trojan connected to the DEV#POPPER malware family. This specific malware family is notorious for providing attackers with extensive control over infected machines, allowing for data exfiltration and further lateral movement within a network.