Two npm packages under the @joyfill namespace delivered a remote access trojan (RAT) when imported into Node.js environments. The compromised beta releases are @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4.
The malware belongs to the DEV#POPPER family. Both packages contained an import-time JavaScript implant that resolves and executes encrypted malicious code upon being loaded by a Node.js application. This attack pattern bypasses conventional static code review because the payload remains encrypted until runtime.
The compromise affects developers and organizations using these beta releases in development or production environments. Any system that imported these specific package versions during the infection window gained a RAT capable of remote command execution, file exfiltration, and lateral movement. The timing of discovery remains unclear, but npm package registries have since been informed.
Organizations should immediately audit their Node.js dependency trees for these exact versions. Developers should check npm package-lock.json and yarn.lock files for any installation records. If either package was installed, treat the affected systems as compromised. Regenerate API keys, tokens, and credentials used on those machines.
The attack demonstrates a persistent supply chain vulnerability. Threat actors target beta and release candidate versions because they receive less scrutiny than stable releases and developers often skip version verification for pre-release dependencies. The DEV#POPPER family has targeted npm before, indicating a focused campaign against JavaScript ecosystems.
npm users should implement strict dependency pinning and consider blocking pre-release versions in corporate environments unless explicitly required. Code scanning tools need configuration tuned to catch encrypted payloads resolved at import time. Package managers now flag suspicious build scripts, but runtime code execution remains harder to detect.
Developers working with @joyfill