Compromised Joyfill npm Packages Deliver DEV#POPPER RAT

Two beta releases of the @joyfill npm namespace, @joyfill/layouts and @joyfill/components, were compromised to deliver a multi-stage remote access trojan (RAT). This activity is attributed to North Korean threat actors and linked to the PolinRider and Contagious Interview campaigns. The attack is notable for its use of a tiered blockchain-based command-and-control (C2) infrastructure involving Tron, Aptos, and BNB Smart Chain to resolve malicious payloads, providing significant operational resilience against traditional domain blocking.

The infection occurs at import-time, meaning the malware executes as soon as the Node.js package is loaded, bypassing typical security measures like `npm install --ignore-scripts`. Once active, the implant can deploy the 'clientCode' RAT for remote shell access and the 'OmniStealer' infostealer, which targets developer credentials, browser data, and cryptocurrency wallets. The malware also implements persistence by modifying local developer tools like VS Code, the GitHub CLI, and the npm global configuration.

This campaign represents a high-risk supply chain attack targeting the frontend development ecosystem. Organizations using @joyfill packages should immediately isolate affected machines, rotate all credentials (including browser-saved passwords and Git tokens), and inspect developer tools for unauthorized modifications.