Two beta releases of joyfill npm Packages have been found distributing a malware implant capable of delivering the DEV#POPPER remote access trojan (RAT) . The compromised Node.js packages use an import-time loader that retrieves encrypted payloads through blockchain transactions instead of traditional command-and-control infrastructure.
The affected releases are @joyfill/[email protected] and @joyfill/[email protected]. Joyfill develops software development kits for embedding forms, documents, and PDFs into web and mobile applications.
While both packages collectively receive around 16,000 weekly npm downloads, researchers noted that the figure overlaps because @joyfill/components depends on @joyfill/layouts, and it does not represent installations of the compromised beta versions.
Joyfill npm Packages Deliver DEV#POPPER RAT Malware
Unlike conventional npm attacks that rely on lifecycle scripts, the malicious code executes when the Node.js module is imported. This means the implant activates during package loading, making npm install –ignore-scripts ineffective once the affected module is used.
Socket’s analysis identified code patterns matching the PolinRider loader family and linked the final payload to the DEV#POPPER malware family. Researchers emphasized that these findings are based on technical similarities and published research rather than attributing the compromise to a specific threat actor.
According to the report, the compromised joyfill npm Packages are capable of arbitrary code execution across development environments, CI runners, test systems, server-side rendering environments, and production builds.
The recovered 77 KB Node.js RAT can collect host information, establish a Socket.IO remote-control channel, execute JavaScript or shell commands, upload files, access clipboard data, and modify developer-related files to maintain persistence.
Blockchain Infrastructure Powers Multi-Stage Malware
Investigators found that both malicious releases were published on 28 July 2026 using Node.js 18.20.0 and npm 10.5.0, with the shared prerelease build marker 2773. Source maps indicate the malicious code was present during the build process, although the report states this does not determine whether attackers compromised a developer workstation, source repository, CI pipeline or publishing credentials.
The malware uses a multi-stage delivery process, retrieving encrypted payloads through Tron, Aptos and BNB Smart Chain transactions. Researchers warned that this blockchain-based approach enables attackers to update payloads without publishing new npm releases.
Additional payloads downloaded by the malware included a detached Node.js bootstrap and a Python credential stealer believed, with medium confidence, to be a variant of OmniStealer.
Recommendations for Developers and Security Teams
The report also noted significant similarities to an incident analysed by eSentire earlier in 2026, in which DEV#POPPER was deployed via a weaponised GitHub repository. However, researchers believe the current campaign most likely resulted from a maintainer compromise rather than a malicious project clone.
Security teams are advised to remove both affected joyfill npm Packages, replace them with verified versions @joyfill/[email protected] and @joyfill/[email protected], isolate any systems that imported the malicious releases, and rotate credentials from unaffected machines.
The researchers also recommend monitoring Node.js environments for unusual blockchain RPC traffic and reviewing systems for persistence mechanisms that may remain even after the packages are removed.
