Executive Summary
In July 2026, beta versions of two npm packages within the @joyfill namespace—@joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4—were compromised to deliver a remote access trojan (RAT) associated with the DEV#POPPER malware family. The malicious code executes upon package import, leveraging a multi-blockchain resolver structure involving Tron, Aptos, and BNB Smart Chain transactions to retrieve and execute encrypted payloads. This sophisticated attack vector enables the deployment of a Node.js RAT capable of file uploads, additional code retrieval, host information collection, and clipboard data access across Windows, macOS, and Linux platforms.
This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The use of blockchain-based command-and-control infrastructure highlights the evolving tactics of threat actors, emphasizing the need for enhanced vigilance and security measures in software development and deployment processes.
Why This Matters Now
The compromise of widely-used npm packages to deliver sophisticated malware like DEV#POPPER highlights the urgent need for developers and organizations to implement stringent supply chain security practices. As threat actors increasingly target open-source ecosystems, proactive measures are essential to mitigate risks associated with software dependencies.
Attack Path Analysis
Attackers compromised beta versions of two npm packages in the @joyfill namespace, embedding a remote access trojan (RAT) that executes upon import into Node.js applications. The RAT employs blockchain-based command-and-control (C2) infrastructure to retrieve and execute malicious payloads, enabling unauthorized access and data exfiltration from compromised systems.
Kill Chain Progression
Initial Compromise
Description
Attackers injected malicious code into beta versions of @joyfill/layouts and @joyfill/components npm packages, which, when imported, executed a remote access trojan (RAT) within Node.js applications.
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
User Execution: Malicious File
Remote Access Software
Command and Scripting Interpreter: JavaScript
Deobfuscate/Decode Files or Information
Application Layer Protocol: Web Protocols
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure the integrity of software and scripts
Control ID: 6.3.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 6
CISA ZTMM 2.0 – Implement Supply Chain Risk Management
Control ID: Supply Chain Risk Management
NIS2 Directive – Supply Chain Security
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Direct exposure to compromised npm packages in supply chain attacks, requiring enhanced package validation, dependency scanning, and zero trust segmentation for development workflows.
Information Technology/IT
High risk from malicious Node.js dependencies enabling remote access trojans, necessitating egress security controls, threat detection systems, and multicloud visibility solutions.
Financial Services
Critical vulnerability to supply chain compromises affecting customer applications, demanding strict compliance controls, encrypted traffic monitoring, and anomaly detection for regulatory protection.
Health Care / Life Sciences
Severe HIPAA compliance risks from RAT infiltration through development dependencies, requiring kubernetes security, intrusion prevention systems, and comprehensive audit capabilities.
Sources
- Two Compromised joyfill npm Packages Run RAT When Imported Into Node.jshttps://thehackernews.com/2026/07/two-compromised-joyfill-npm-packages.htmlVerified
- Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojanhttps://www.stepsecurity.io/blog/joyfill-npm-supply-chain-compromiseVerified
- Axios NPM Supply Chain Compromise: Malicious Packages Deliver Remote Access Trojanhttps://www.sans.org/blog/axios-npm-supply-chain-compromise-malicious-packages-remote-access-trojanVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The CNSF would likely limit the RAT's ability to communicate with unauthorized external servers, reducing the risk of further malicious payloads being retrieved.
Control: Zero Trust Segmentation
Mitigation: Zero Trust Segmentation would likely constrain the RAT's access to sensitive resources, limiting its ability to escalate privileges within the environment.
Control: East-West Traffic Security
Mitigation: East-West Traffic Security would likely restrict the RAT's ability to move laterally, thereby limiting its reach to other systems.
Control: Multicloud Visibility & Control
Mitigation: Multicloud Visibility & Control would likely detect and limit unauthorized communications with external C2 servers, reducing the RAT's ability to receive further instructions.
Control: Egress Security & Policy Enforcement
Mitigation: Egress Security & Policy Enforcement would likely limit the RAT's ability to exfiltrate data, reducing the risk of sensitive information being transmitted to external servers.
The CNSF would likely limit the overall impact by containing the attacker's activities to the initially compromised workload, reducing the blast radius.
Impact at a Glance
Affected Business Functions
- Software Development
- Continuous Integration/Continuous Deployment (CI/CD) Pipelines
- Application Security
Estimated downtime: 7 days
Estimated loss: $50,000
Potential exposure of sensitive credentials, including API keys, database passwords, and personal identifiable information (PII) due to the remote access trojan and credential stealer deployed by the compromised packages.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict unauthorized lateral movement within the network.
- • Deploy Egress Security & Policy Enforcement to monitor and control outbound traffic, preventing unauthorized data exfiltration.
- • Utilize Threat Detection & Anomaly Response systems to identify and respond to unusual activities indicative of compromise.
- • Ensure Multicloud Visibility & Control to maintain oversight across diverse cloud environments and detect anomalous interactions.
- • Regularly audit and monitor third-party packages and dependencies to identify and mitigate supply chain vulnerabilities.
