Security researchers have identified a supply chain attack targeting the @joyfill npm namespace, where two beta packages deliver a Remote Access Trojan (RAT). Developers using `@joyfill/layouts` or `@joyfill/components` specific versions are urged to update immediately.
Key Takeaways
- Affected Packages: @joyfill/[email protected] and @joyfill/[email protected] are compromised.
- Malware Type: The packages inject an implant linked to the DEV#POPPER family, known for RAT capabilities.
- Action Required: Immediate removal and patching of these specific versions are critical to prevent system takeover.
A sophisticated supply chain attack has been detected within the Node.js ecosystem, specifically targeting the @joyfill namespace. Two beta release versions of popular npm packages have been tampered with to include a malicious script designed to deploy a Remote Access Trojan (RAT). This attack allows unauthorized actors to gain control over systems that import these compromised libraries.
Technical Breakdown of the Attack
The malicious activity was identified in @joyfill/layouts (version 0.1.2-2773.beta.0) and @joyfill/components (version 4.0.0-rc24-2773-beta.4). According to security reports, these packages contain a JavaScript implant that executes immediately upon import—often referred to as an "import-time" attack. The implant resolves encrypted code, eventually deploying the DEV#POPPER malware, which creates a backdoor for remote control.
Historical Context of npm Attacks
The npm registry has become a frequent target for cybercriminals looking to maximize their reach. Historically, high-profile attacks on packages like event-stream and ua-parser-js have demonstrated how poisoning a single dependency can compromise thousands of downstream projects. Unlike those attacks, this incident specifically targets beta versions, exploiting the reduced scrutiny often applied to pre-release software.
Why This Matters
BozokMedia analysis shows that attacks on beta and release candidate (RC) versions are increasing. Developers often assume these versions are safe for testing environments, but this incident proves that attackers are actively abusing the trust placed in the open-source supply chain. Once a RAT is installed, it can steal sensitive credentials, move laterally across networks, and deploy ransomware.
"The targeting of beta releases is a tactical shift by attackers; they know developers often lower their guard for non-stable versions, creating a perfect window for infection."
| Component | Risk Level |
|---|---|
| Import-time Execution | Critical (Executes immediately) |
| Encrypted Payload | High (Hard to detect by scanners) |
| RAT Capabilities | Severe (Full system control) |
Frequently Asked Questions
1. How can I check if my project is infected?
Check your `package-lock.json` file for the specific versions mentioned above (0.1.2-2773.beta.0 and 4.0.0-rc24-2773-beta.4) and run a security audit on your dependencies.
2. What should I do if I find these packages?
Immediately downgrade to a previous stable version, audit your system for signs of intrusion, and rotate any credentials stored on the affected machine.
