- Two beta npm packages from @joyfill were compromised to deliver the DEV#POPPER remote access trojan, using a multi-blockchain resolver structure.
- The malware retrieves encrypted commands via Tron, Aptos, and BNB Smart Chain transactions, offering operational resilience and payload switching without new package versions.
- The attack is linked to the North Korean threat cluster PolinRider, which also targeted the Vite ecosystem with similar blockchain-based command-and-control.
Security researchers have uncovered two compromised beta npm packages—@joyfill/layouts and @joyfill/components—that deliver a remote access trojan from the DEV#POPPER malware family. The packages contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions, according to an analysis by Socket.
Unlike typical malicious packages that trigger via npm lifecycle hooks, this implant runs automatically when Node.js loads the CommonJS entry point. Consequently, the use of a multi-blockchain resolver structure has been linked to the PolinRider threat cluster, which is assessed to be related to the Contagious Interview campaign.
The implant executes two parallel sequences: an in-process branch that retrieves a 77 KB JavaScript payload similar to DEV#POPPER, and a secondary branch that launches a detached Node.js process to fetch a separate boot payload. If the initial blockchain query to a Tron address fails, the malware falls back to an Aptos account to obtain a BSC transaction, then decrypts and executes the JavaScript code.
The final payload, “clientCode,” is a heavily obfuscated Node.js RAT capable of uploading files, reading clipboard data, and collecting host information. It also avoids execution on machines with hostnames like github-runner or buildbot. Meanwhile, the detached process delivers both the clientCode RAT and a Python infostealer—an iteration of OmniStealer—that harvests credentials, browser data, and developer tool configurations.
Socket told The Hacker News that both the ViteVenom campaign and these latest npm packages are part of the same ongoing operation by North Korean threat actors. Developers who installed the affected versions should remove them from lockfiles, caches, and build artifacts, and rotate any credentials exposed to the compromised Node.js process.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
