Compromised @joyfill npm Packages Deliver DEV#POPPER RAT
First seen Jul 29, 2026 · Updated Jul 29, 2026
Two beta releases of npm packages in the @joyfill namespace were compromised to include an import-time JavaScript implant that deploys a remote access trojan linked to the DEV#POPPER campaign. Developers or automated build pipelines that installed the affected beta versions could have unknowingly executed malicious code upon package import, granting attackers remote access to the host.
Technical Analysis
The affected packages, @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4, contain an import-time execution mechanism that decrypts and runs embedded payload code as soon as the package is loaded into a Node.js runtime, a technique consistent with the DEV#POPPER malware family previously tied to North Korean-aligned actors targeting developers. The implant likely uses encrypted or obfuscated strings to evade static analysis tools and npm registry scanning, decrypting the RAT payload only at runtime to establish command-and-control connectivity. Because the compromise occurred in beta/pre-release tags rather than stable versions, it likely targeted developers pulling bleeding-edge dependencies, CI/CD systems auto-resolving beta tags, or testing environments with less scrutiny. Any host running these packages—including developer workstations, build servers, or AI agent orchestration environments that dynamically install npm dependencies for tool use, code execution, or RAG pipeline components—could be compromised, exposing API keys, cloud credentials, and agent configuration secrets to the attacker. This represents a direct risk to AI agent frameworks that automatically fetch and execute npm packages as part of their tool-calling or sandboxed code-execution capabilities, potentially allowing lateral movement or credential theft.
Affected Systems
Node.js environments with @joyfill/layouts@0.1.2-2773.beta.0 or @joyfill/components@4.0.0-rc24-2773-beta.4 installed; CI/CD pipelines and developer machines that auto-resolve beta/pre-release npm tags
Indicators of Compromise
- @joyfill/layouts@0.1.2-2773.beta.0
- @joyfill/components@4.0.0-rc24-2773-beta.4
Remediation Steps
- 1
Audit dependencies
Scan package-lock.json, yarn.lock, and node_modules across all projects and CI systems for the named compromised package versions.
- 2
Remove and pin safe versions
Uninstall the affected beta releases immediately and pin to known-clean, stable versions of @joyfill packages.
- 3
Rotate credentials
Rotate any API keys, tokens, or secrets that may have been present on systems where the compromised packages were installed or executed.
- 4
Restrict beta/pre-release installs
Configure package managers and CI/CD pipelines to disallow automatic installation of beta, rc, or pre-release npm tags without manual review.
- 5
Monitor for RAT indicators
Inspect hosts for unexpected outbound network connections, unauthorized process execution, or persistence mechanisms consistent with DEV#POPPER RAT behavior.
- 6
Enable package integrity verification
Use lockfile integrity checks, npm provenance, and SCA tooling to detect tampered or newly published malicious packages before they reach agent or developer environments.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.