Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan — Threadlinqs Intelligence
As of 2026-08-13, Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan is a critical-severity supply chain threat attributed to Contagious Interview - G1052 (North Korea (DPRK)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 61 indicators of compromise.
Threat ID: TL-2026-1746 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Updated: 2026-08-13 · 5 updates · revalidated 3×
Attribution: Contagious Interview - G1052 · North Korea (DPRK) · FINANCIAL
Beta releases of two npm packages in the @joyfill namespace (@joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4), published July 28, 2026 by the same npm identity,
On 2026-07-28, the Socket Threat Research Team identified two malicious beta releases in the @joyfill npm namespace: @joyfill/layouts@0.1.2-2773.beta.0 (published 10:54:57 UTC) and @joyfill/components@4.0.0-rc24-2773-beta.4 (published 11:03:59 UTC), both published by the same npm identity using Node.js 18.20.0 and npm 10.5.0. The malicious code was present in the published bundle at publish time rather than injected via a compromised install script, indicating either maintainer credential compromise or compromised build/CI infrastructure upstream of `npm publish`.
The implant executes at import time (no install-script trigger, so `npm install --ignore-scripts` provides no protection) and runs a three-stage architecture. Stage 0 (Bootstrap) forks both an in-process path and a detached `child_process.spawn({ detached: true })` path. Stage 1 (Blockchain Dispatch) resolves encrypted payload material with no reliance on conventional DNS/HTTP C2 infrastructure: it reads Tron account transactions (`TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP` in-process, `TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG` detached), falls back to Aptos account transactions, and to BNB Smart Chain transactions retrieved via `eth_getTransactionByHash`, decoding and XOR-decrypting the transaction payload with path-specific keys. This blockchain-as-dead-drop-resolver pattern makes takedown far harder than IP/domain blocklisting, since the resolver infrastructure is a public, permissionless ledger. Stage 2 delivers the 77KB Node.js RAT (SHA-256 26351aed0397158d3a3b8cc8fd3047d4c015d264c9895f10f20f1521b974ed18) via a second-tier blockchain resolution. A parallel detached "boot downloader" process independently requests `23.27.13.43/$/boot` with a custom `Sec-V: A9-0135-3` header and decrypts the response with the key `ThZG+0jfXE6VAGOJ`.
The delivered RAT exposes a socket.io-style command vocabulary (`ss_eval`/`ss_eval64` for JS/base64 execution, `ss_upf`/`ss_upd` for file transfer, `ss_dir` for directory enumeration, `ss_fcd` for file modification/traversal), reads the OS clipboard (PowerShell on Windows, `pbpaste`/`xclip`/`xsel` on Unix), enumerates Windows processes, and calls `ip-api.com` for public-IP fingerprinting. It persists by patching Node.js-hosted developer tools directly: `@vscode/deviceid` (covering VS Code, Cursor, and Antigravity), the Discord Desktop core module, GitHub Desktop's `resources/app/main.js`, and the global npm CLI at `node_modules/npm/lib/cli.js` — guaranteeing re-execution on next launch of any of those apps. Injected code carries recognizable markers (`/*C250617A*/`, `/*RS260605*/`).
The `/$/boot` response delivers a second payload: an 82KB Python infostealer (SHA-256 36ff00b45e67baa7e3674b0c80f48e88737264c61e5c6b3b091200972de8157c) that harvests Windows Credential Manager and Linux Secret Service entries, Chromium/Firefox storage, wallet-manager and password-manager browser extensions, Git credentials and GitHub CLI config, and VS Code storage — staging everything as an AES-encrypted ZIP (password `,./,./,./`) under `%USERPROFILE%\.npm` (Windows) or `/tmp/.npm` (Linux/macOS) before optional Telegram-bot exfiltration. Socket assesses "medium likelihood" this is an iteration of the OmniStealer family.
Attribution ties this incident to the DEV#POPPER malware family via shared structural fingerprints: the PolinRider-family multi-chain loader structure (`rmcej%otb%` marker, shared global-naming conventions), the identical `Sec-V` header scheme and `/$/boot` endpoint design, the `ss_*` socket.io command vocabulary, and matching XOR key derivation. DEV#POPPER was first documented by eSentire's Threat Response Unit (TRU) in a February 2026 incident on an Energy/Utilities/Waste customer host, where a victim cloned a weaponized GitHub repository ("ShoeVista", disguised as an e-commerce platform), launched its frontend, and triggered a Node.js backdoor hidden by whitespace padding in `frontend/tailwind.config.js`. eSentire attributes DEV#POPPER with high
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-1357
Target sectors: technology, softwaredevelopment, energy, utilities, cryptocurrency
Target regions: Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 61 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1583, T1587, T1195, T1078, T1204, T1129, T1059, T1554, T1027, T1140
