Compromised Joyfill npm beta packages delivered blockchain-resolved RAT

Two prerelease packages in the legitimate @joyfill npm namespace — @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4 — were published with malicious code embedded in their distribution bundles, causing the payload to run when the package was imported rather than during installation. Researchers said the implant exposed Node.js require and module globally, resolved command-and-control infrastructure through transactions on Tron, Aptos, and BNB Smart Chain, and then fetched additional payloads including a Node.js remote-access trojan that opened a Socket.IO channel and a downloader contacting 23[.]27[.]13[.]43/$/boot with the header Sec-V: A9-0135-3.

Analysis linked the recovered malware to the PolinRider loader family and DEV#POPPER, while downstream activity also showed a Python credential stealer assessed as a likely OmniStealer variant targeting developer workstations. The compromise affects development environments, CI runners, test tooling, server-side rendering, and build systems that import the packages, and protections such as npm install --ignore-scripts do not prevent execution because the malicious logic was bundled before publication. Investigators said earlier versions, including @joyfill/layouts@0.1.1 and @joyfill/components@4.0.0-rc24, appeared clean, and advised organizations to treat any environment using the 2773 prerelease versions as compromised, remove them, rebuild from trusted lockfiles, inspect for persistence, and rotate exposed credentials.