Two npm packages in the @joyfill namespace have been discovered to contain remote access trojan (RAT) malware. These compromised beta versions aim to infect systems using the Node.js environment with malicious code linked to the DEV#POPPER malware family.
Affected Packages and Malware Delivery
The impacted packages include @joyfill/[email protected] and @joyfill/[email protected]. An analysis by Socket revealed that these packages employ a JavaScript implant activated during import, resolving encrypted code through transactions on the Tron, Aptos, and BNB Smart Chain blockchains.
This method differs from typical malicious packages, which usually activate via npm lifecycle hooks. Instead, the JavaScript implant executes as soon as the Node.js loads the CommonJS package entry point, indicating a sophisticated attack strategy.
Blockchain Utilization and Threat Analysis
The attack employs a multi-blockchain resolver structure, previously associated with a threat group known as PolinRider, and related to Contagious Interview. This approach enables operational flexibility, allowing payload changes without the need to update package versions.
Earlier reports by Checkmarx and OpenSourceMalware identified similar strategies in the ViteVenom campaign, targeting Vite frontend tooling with a tiered blockchain C2 infrastructure. This method delivers RATs capable of reverse shells, credential theft, and persistent backdoor injections.
Payload Execution and Developer Precautions
The malware initiates with a JavaScript loader that retrieves a secondary malware stage named “clientCode” through blockchain resolution. A separate Node.js process also engages a different IP address to execute additional code.
Developers using these packages should remove affected versions from their systems, including lockfiles, caches, and build images. It’s crucial to switch to a verified version and update credentials to mitigate risks.
Socket advises that the @joyfill/layouts package poses a threat of arbitrary code execution, affecting development environments, CI runners, and more. The ultimate payload can collect host data, establish remote connections, and execute various commands, posing significant security risks.
The incident highlights ongoing cybersecurity challenges, emphasizing the need for vigilance in package management and the importance of maintaining secure development practices.
