SocketPublished
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
By Socket Research Team
Excerpt
Sidebar CTA Background
Secure your dependencies with us
Socket proactively blocks malicious open source packages in your code.
Install
Two npm beta releases in the @joyfill namespace contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions. Static analysis shows that its primary branch reaches a 77 KB Node.js remote-access trojan. A parallel branch launches a detached Node.js process, requests a separate boot payload from 23[.]27[.]13[.]43/$/boot , sends the marker header Sec-V: A9-…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Socket on socket.dev.
Mentioned in the excerpt
More from Socket2
- Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40 PackagesSocket · Published 15 Sep 2025
- GlassWorm Loader Hits Open VSX via Developer Account CompromiseSocket · Published 31 Jan
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Attackers Target Agents via The Skill Supply Chainzenity.io · Published 6 Aug
