Compromised Beta Releases of @joyfill npm Packages Deliver RAT via Import-Time Implant

Two beta-tagged releases in the @joyfill npm namespace — @joyfill/[email protected] and @joyfill/[email protected] — were found to be compromised, according to reporting by The Hacker News. The packages reportedly contain an import-time JavaScript implant that resolves and executes encrypted code as soon as the module is loaded into a Node.js project, delivering a remote access trojan (RAT) associated with the DEV#POPPER malware family.

Why It Matters

Because the payload triggers on import rather than requiring any explicit function call, simply installing and loading one of these beta packages — whether directly or as a transitive dependency pulled in by an automated build or CI pipeline — can be enough to execute attacker-controlled code on a developer machine or build server. Beta/pre-release tags are often pulled in deliberately for testing or accidentally via loose version ranges, making this a supply-chain risk for any team using or evaluating @joyfill packages. DEV#POPPER has previously been linked to campaigns targeting developers, so credential theft, source code exposure, and lateral movement from a compromised dev environment are realistic follow-on risks.

What Defenders Should Do Now

• Audit package.json/lockfiles across projects for the specific compromised versions (@joyfill/[email protected] and @joyfill/[email protected]) and any other beta/rc tags from this namespace.
• Review npm install/CI logs for outbound network connections or process spawns immediately following package installation — import-time implants often reach out shortly after npm install or on first module load.
• Hunt for indicators consistent with DEV#POPPER activity on developer endpoints and build agents (unexpected persistence, RAT command-and-control traffic, encrypted/obfuscated script execution from within node_modules).
• Pin dependencies to known-good, non-prerelease versions and restrict automatic pulling of beta/rc tags in CI, especially for third-party UI/form libraries like joyfill.
• If any affected version was installed, treat the host as potentially compromised: rotate credentials, inspect for persistence, and rebuild from a clean environment rather than simply uninstalling the package.

Developing Story

This is a net-new report and details — including full scope, indicators of compromise, and whether the compromise stemmed from a maintainer account takeover or another vector — were not fully specified at time of writing. Defenders should treat this as evolving intelligence and monitor the original source for updates: The Hacker News coverage.