Joyfill npm Packages Compromised: A Deep Dive into the DEV#POPPER Supply Chain Attack
In July 2026, beta versions of two npm packages within the @joyfill namespace—@joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4—were compromised to deliver a remote access trojan (RAT) associated with the DEV#POPPER malware family. The malicious code executes upon package import, leveraging a multi-blockchain resolver structure involving Tron, Aptos, and BNB Smart Chain transactions to retrieve and execute encrypted payloads. This sophisticated attack vector enables the deployment of a Node.js RAT capable of file uploads, additional code retrieval, host information collection, and clipboard data access across Windows, macOS, and Linux platforms. This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The use of blockchain-based command-and-control infrastructure highlights the evolving tactics of threat actors, emphasizing the need for enhanced vigilance and security measures in software development and deployment processes.
Kill Chain
