Joyfill npm beta releases carried a DEV#POPPER RAT

Two prerelease versions of Joyfill's npm packages shipped a remote access trojan on July 28, 2026. Joyfill sells document and form tooling, and its @joyfill/components and @joyfill/layouts packages are used for forms and layout work in web applications.

Socket, which analyzed the releases, identified @joyfill/[email protected], published at 10:54:57 UTC, and @joyfill/[email protected], published nine minutes later at 11:03:59. In both, the implant was appended after the legitimate package code and hidden under several layers of JavaScript obfuscation, including seeded character shuffling and dynamically constructed functions.

Execution happened at import time. That detail mattered more than the payload itself, because it means npm install --ignore-scripts, the mitigation most organizations adopted after two years of postinstall worms, offered nothing. The code exposed Node's require and module on the global object, then resolved its command-and-control address by querying Tron and Aptos addresses and retrieving encrypted code through BSC transactions, which it XOR-decrypted and evaluated. Using a public blockchain as the address book means the operators can rotate infrastructure without shipping a new package.

What arrived was a 77 KB remote access trojan associated with the DEV#POPPER family, supporting JavaScript evaluation, shell execution, file management, and clipboard theft, followed by an 82,457-byte Python credential harvester that collected browser data, wallet extensions, and Git credentials. The malware also injected itself into developer tooling, including VS Code and npm, to survive removal of the package. Socket advised treating affected machines as compromised rather than merely at risk, and pinning back to @joyfill/layouts 0.1.1 and @joyfill/components 4.0.0-rc24.