Ethical Hacking News
A recent discovery highlights the vulnerability of even seemingly secure npm packages when they are not thoroughly audited. Two compromised packages in the @joyfill namespace have been found to run remote access trojans (RATs) associated with the DEV#POPPER malware family, demonstrating the need for better security auditing practices in open-source software development.
The discovery of compromised npm packages highlights the vulnerability of even seemingly secure open-source software when it's not thoroughly audited. Security researchers found two compromised packages in the @joyfill namespace that ran remote access trojans (RATs) associated with the DEV#POPPER malware family. The affected packages used a multi-blockchain resolver structure, making it difficult to track and monitor the malware's activities. North Korean threat actors are linked to the ongoing operation using npm packages, with both malicious versions published by the same identity. Developers who installed the affected packages are advised to remove them and pin to a verified version, and rotate credentials from the affected Node.js process.
The world of software development is filled with intricate web of dependencies and trust. When an open-source package is released, it's often assumed that its creators have performed thorough testing to ensure it doesn't contain any malicious code. However, a recent discovery highlights the vulnerability of even seemingly secure packages when they are not thoroughly audited.
In June 2026, security researchers at Socket discovered two compromised npm packages in the @joyfill namespace, which ran remote access trojans (RATs) associated with the DEV#POPPER malware family. The affected packages were @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4.
According to Socket, these two compromised npm packages contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions. The use of a multi-blockchain resolver structure comprising Tron, Aptos, and BNB Smart Chain (BSC) has been linked to a threat cluster tracked as PolinRider, which is assessed to be related to Contagious Interview.
The implant in the two affected packages runs when Node.js loads the CommonJS package entry point, unlike other malicious packages that are triggered via an npm lifecycle hook. The use of blockchain-based command-and-control (C2) infrastructure makes it difficult for security researchers to track and monitor the malware's activities.
However, Socket found that both ViteVenom and the latest collection of npm packages are connected to the same ongoing operation by North Korean threat actors. Both malicious versions are said to have been published by the same npm identity using Node.js 18.20.0 and npm 10.5.0, with the code present at bundle time.
Developers who have installed the affected versions are advised to remove them from lockfiles, caches, internal mirrors, build images, and deployment artifacts, pin to a verified version, and rotate credentials from the affected Node.js process.
The final "clientCode" payload is heavily obfuscated and functions as a Node.js RAT with the following features, while avoiding execution on development, CI, or sandboxed machines with the hostnames github-runner, buildbot, buildkitsandbox, and microsoft-standard-WSL2 - Upload files to the configured upload host, Retrieve additional JavaScript, Collect basic host details, Send status check-in messages, Read clipboard data through PowerShell on Windows, pbpaste on macOS, and xclip or xsel on Linux.
Two payloads have been associated with the detached process: the "clientCode" RAT and a Python infostealer that can harvest a wide range of data from compromised hosts. It's assessed to be an iteration of the OmniStealer malware.
The data collected by the malware includes Environment and host information, Windows Credential Manager and Linux Secret Service data, Chromium and Firefox browser data, Browser extension storage for wallets and password managers, Git credentials, GitHub CLI configuration, GitHub Desktop logs, Microsoft Visual Studio Code storage.
According to Socket, it's currently not clear if this source code injection was achieved following a compromise of a developer workstation, source repository, CI environment, or publishing credentials.
The use of blockchain-based command-and-control infrastructure offers operational resilience and makes it possible to switch payloads without having to publish a new version of the packages. However, this also means that security researchers can be outsmarted by attackers who can easily update their payloads, making it challenging for them to track the malware's activities.
In conclusion, the compromised npm packages highlight the vulnerability of even seemingly secure open-source software when they are not thoroughly audited. As the use of blockchain-based command-and-control infrastructure becomes more widespread, security researchers must develop new strategies to keep pace with these evolving threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Malware-Compromised-npm-Packages-The-Unintended-Consequences-of-Open-Source-Software-ehn.shtml
https://thehackernews.com/2026/07/two-compromised-joyfill-npm-packages.html
https://vulners.com/thn/THN:B38BFD1273C956F6437ABCF52A38F76D
https://www.esentire.com/blog/north-korean-apt-malware-analysis-dev-popper-rat-and-omnistealer-everyday-im-shufflin
https://securityonline.info/north-korean-apt-unleashes-devpopper-rat-via-github-to-drain-crypto-wallets/
Published: Tue Jul 28 23:54:07 2026 by llama3.2 3B Q4_K_M
