Joyfill npm Packages Compromised with Blockchain C2 Loader — Threadlinqs Intelligence
As of 2026-08-13, Joyfill npm Packages Compromised with Blockchain C2 Loader is a medium-severity supply chain threat attributed to PolinRider (North Korea (DPRK)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1771 · Severity: MEDIUM · Status: ACTIVE · Category: SUPPLY_CHAIN
Updated: 2026-08-13 · 2 updates
Attribution: PolinRider · North Korea (DPRK) · FINANCIAL
Two @joyfill npm packages (@joyfill/components and @joyfill/layouts) were published on 2026-07-28 with 62 lines of obfuscated JavaScript injected directly into production dist bundles, executing at
On 2026-07-28, threat actors published malicious versions of two legitimate npm packages, @joyfill/components and @joyfill/layouts, at 10:54 UTC and 11:03 UTC respectively. Unlike typical npm supply-chain attacks that rely on postinstall scripts, the compromise here was injected directly into the packages' already-built production bundles (dist/index.cjs.js and dist/index.es.js): 62 lines of obfuscated code were spliced between the last legitimate utility function (sortLayoutItemsByColRow) and the FieldLayoutTypes constant, and the layouts bundle itself was swapped from a clean 37,318-line file for a 1,271-line malicious replacement built with vite-plugin-css-injected-by-js. Because the payload runs as a side effect of require()/import, any application pulling these versions executed attacker code automatically with no install-time trigger to detect.
The loader implements a three-stage, cross-chain dead-drop C2. Stage 1 sets a campaign marker in global scope (global["!"] = "9-0135-3") and exposes require/module globally, then queries the Tron blockchain (api.trongrid.io) for the latest transaction on a hardcoded address to obtain routing data, falling back to a Binance Smart Chain lookup (bsc-dataseed.binance.org, with bsc-rpc.publicnode.com as a secondary RPC) and decrypting the result with a hardcoded XOR key. Stage 2 reads the campaign marker to select one of three hardcoded HTTP C2 endpoints (166.88.134.62:443, 198.105.127.210:443, or a fallback at 23.27.202.27:27017 deliberately using the MongoDB port to blend in) while independently resolving a second Tron dead-drop address for command routing. If the primary path fails, the malware spawns a detached `node -e` child process with `windowsHide: true` and `stdio: "ignore"`, allowing the payload to persist after the parent process (and even the host application) exits. Decryption of the relayed blockchain transaction yields a 77KB LZ-compressed RAT client whose structure matches the PolinRider bot family, providing reverse-shell, credential-harvesting, file-exfiltration, and persistent-backdoor capability consistent with public reporting on PolinRider/DEV#POPPER-linked payloads.
Both malicious versions were unpublished by roughly 21:00 UTC the same day (~10 hours of exposure), but remained available on registry mirrors such as registry.npmmirror.com after the upstream takedown. Critically, the primary Tron dead-drop address (TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP) and the Aptos fallback hash pattern are identical to those used in the prior astro.config.mjs supply-chain campaign (a malicious pull request against the Egonex-AI/Understand-Anything repository, disclosed 2026-06-12), which used the same decoder function, shuffle marker, and dead-drop pattern documented by OpenSourceMalware as PolinRider-attributed. That campaign, in turn, sits inside a much larger 2026 wave of DPRK-linked npm/GitHub/Go/Composer/Chrome-extension compromises (ChainVeil, ViteVenom/SuccessKey, the mgc RAT package, and the 108-package PolinRider campaign) all sharing blockchain dead-drop infrastructure across Tron, BSC, and Aptos. The underlying technique -- storing and resolving C2 commands via public blockchain transactions instead of seizable domains/IPs (EtherHiding) -- was first documented by Mandiant in October 2025 as a DPRK tradecraft shift, and is formalized in Malpedia as the js.jadesnow (aka ChainedDown) downloader family, attributed to the WageMole/Famous Chollima/UNC5342/PurpleBravo cluster (a Lazarus Group / Contagious Interview offshoot) that typically delivers INVISIBLEFERRET as a follow-on persistent backdoor.
Because command resolution depends on public, unseizable blockchain RPC infrastructure rather than attacker-controlled domains, blocking the observed HTTP C2 IPs alone does not stop the second-stage compromise -- the Tron/BSC/Aptos dead-drop can still deliver a new payload pointer to any already-infected host. Defenders should treat outbound calls to Tron/BSC/Aptos public RPC end
Target sectors: technology, software-development
Target regions: Global
Update History
- 2026-08-13 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 67 community-related indicator(s).
- 2026-08-04 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 117 community-related indicator(s).
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, MEDIUM, threat intelligence, cybersecurity, T1587.001, T1588.001, T1583.006, T1608.001, T1195.001, T1195.002, T1199, T1059.007, T1129, T1554
