Booby-trapped @joyfill npm packages hide a remote-control trojan

Key points

• Two beta versions of @joyfill packages on npm, the world's largest repository of JavaScript code, were altered to hide malware.
• The affected releases are @joyfill/layouts version 0.1.2-2773.beta.0 and @joyfill/components version 4.0.0-rc24-2773-beta.4.
• The hidden code installs a remote access trojan, a type of malware that lets attackers control an infected computer from afar.
• The attack is linked to DEV#POPPER, a campaign researchers have tied to North Korean operators who target software developers.
• Any developer who installed the beta versions should treat their machine as potentially infected and rotate stored credentials.

Someone slipped malicious code into two beta releases of a widely used JavaScript library. Developers who installed them handed their computer to an attacker the moment they hit run.

The packages sit in the @joyfill namespace on npm, the giant online library where JavaScript programmers download ready-made code to plug into their projects. Think of npm as an app store for building blocks of software. When a block is poisoned, every app built on top of it inherits the poison.

What exactly got tampered with?

Two specific beta releases, not the stable versions most people use in production. The affected files are @joyfill/layouts at version 0.1.2-2773.beta.0 and @joyfill/components at version 4.0.0-rc24-2773-beta.4, flagged by researchers and covered by The Hacker News.

Beta releases are early test versions. Attackers like targeting them: fewer eyes on the code, the same trust as the main product. We covered a nearly identical tactic in July, when a poisoned Jscrambler release fired its payload the moment you installed it.

How does the attack work?

The poisoned packages contain what researchers call an import-time implant. The malicious code runs the instant a developer's project loads the library, before the developer has written a single line using it.

That hidden code reaches out to a server controlled by the attackers, pulls down an encrypted payload, and decrypts it on the victim's machine. The result is a remote access trojan, or RAT: malware that gives an attacker a live connection into the infected computer. From there they can read files, steal saved passwords, pivot to company systems, and drop further tools.

This isn't a novel AI-driven technique. It's a classic poisoned-dependency trick: hide bad code inside something trusted and let the auto-installers do the work. The web parallel is a compromised script tag on a page you visited yesterday.

Who is behind it?

Researchers have linked the implant to the DEV#POPPER malware family, associated with North Korean groups that specifically hunt software developers. Their playbook has included fake coding tests and now poisoned npm packages. The goal is access to developer machines, which often hold keys to bigger prizes: source code, cloud accounts, cryptocurrency wallets. North Korean groups' use of npm as a delivery channel isn't new to this beat either; our 3 July report traced fake Rollup Helper packages to the same broad threat cluster.

What should developers and their employers do?

If your team installed either beta version, treat the machine as compromised. Rebuild it from a clean image, rotate every credential stored or typed on it, then check outbound network logs for unusual connections around the install date. Purge the malicious versions from any private mirror or cache.

Ordinary users of apps built on Joyfill aren't directly in the firing line. The risk sits with developers who pulled the poisoned beta into their own code. That said, if a company you rely on used those betas in production, expect a disclosure in the coming days.

Joyfill had not published a public advisory at the time of writing. The offending versions appear to have been pulled from npm.

Common questions

Am I at risk as a normal app user?

Only indirectly. The attack targets developers' laptops, not end users of finished apps. If a company you use built its product on the bad beta versions, wait for their disclosure notice.

How do I know if my developer machine is infected?

Check your npm install history for the two named versions. If either appears, assume the machine is compromised, rebuild it, and change every password and access token it held.