Booby-trapped @joyfill npm packages hide a remote-control trojan

Key points

• Two beta versions of @joyfill packages on npm, the world's largest repository of JavaScript code, were altered to hide malware.
• The affected releases are @joyfill/layouts version 0.1.2-2773.beta.0 and @joyfill/components version 4.0.0-rc24-2773-beta.4.
• The hidden code installs a remote access trojan, a type of malware that lets attackers control an infected computer from afar.
• The attack is linked to DEV#POPPER, a campaign researchers have tied to North Korean operators who target software developers.
• Any developer who installed the beta versions should treat their machine as potentially infected and rotate stored credentials.

Someone slipped malicious code into two beta releases of a widely used JavaScript library, and any developer who installed them handed their computer to an attacker the moment they hit run.

The packages sit in the @joyfill namespace on npm, the giant online library where JavaScript programmers download ready-made code to plug into their own projects. Think of npm as an app store for building blocks of software. When a block is poisoned, every app built on top of it inherits the poison.

What exactly got tampered with?

Two specific beta releases, not the stable versions most people use in production. The affected files are @joyfill/layouts at version 0.1.2-2773.beta.0 and @joyfill/components at version 4.0.0-rc24-2773-beta.4, first flagged by researchers and covered by The Hacker News.

Beta releases are early test versions. Developers install them to try upcoming features. That is precisely why attackers like targeting them: fewer eyes, faster turnover, and the same trust as the main product.

How does the attack work?

The poisoned packages contain what researchers call an import-time implant. In plain English: the malicious code runs the instant a developer's project loads the library, before the developer has written a single line using it.

That hidden code reaches out to a server controlled by the attackers, pulls down an encrypted payload, and decrypts it on the victim's machine. The final payload is a remote access trojan, or RAT, which is malware that gives an attacker a live connection into the infected computer. From there they can read files, steal saved passwords, pivot to company systems, and drop further tools.

This is not a new AI-driven attack or some exotic supply-chain novelty. It is a classic dependency-confusion-adjacent trick: put bad code inside something trusted and wait for the auto-installers to do the work. The web-security parallel is a compromised script tag on a page you already visited yesterday.

Who is behind it?

Security researchers have linked the implant to the DEV#POPPER malware family, a set of tools associated with North Korean groups that specifically hunt software developers. The playbook usually involves fake job interviews, malicious coding tests, and now, poisoned npm packages. The end goal is access to developer machines, which often hold keys to bigger prizes: source code, cloud accounts, cryptocurrency wallets.

What should developers and their employers do?

If your team installed either beta version, treat the machine as compromised. Rebuild it from a clean image, rotate every credential that was stored or typed on it, and check outbound network logs for unusual connections around the install date. The malicious versions should be purged from any private mirror or cache.

Ordinary users of apps built on Joyfill are not directly in the firing line here. The risk sits with the developers who pulled the poisoned beta into their own code. Still, if a company you rely on used those betas in production, expect a disclosure notice in the coming days.

Joyfill has not, at time of writing, published a public advisory. The offending versions appear to have been pulled from npm.

Common questions

Am I at risk as a normal app user?

Only indirectly. The attack targets developers' laptops, not end users of finished apps. If a company you use built its product on the bad beta versions, wait for their notice.

How do I know if my developer machine is infected?

Check your npm install history for the two named versions. If either appears, assume the machine is compromised, rebuild it, and change every password and access token it held.