DEV#POPPER RAT Hidden in Two Joyfill npm Packages

Two beta releases in the @joyfill npm namespace have been confirmed malicious. @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4 both contain an import-time JavaScript implant that decrypts and executes a remote access trojan the moment either package loads into a Node.js process, according to The Hacker News. The payload is attributed to the DEV#POPPER malware family — a North Korea-nexus threat cluster with a documented pattern of targeting developers through npm dependency poisoning and fake job interview schemes.

What changed

• @joyfill/layouts@0.1.2-2773.beta.0 — malicious beta release; import-time RAT delivery
• @joyfill/components@4.0.0-rc24-2773-beta.4 — malicious beta release; same implant
• The implant resolves encrypted code at load time. Execution happens before your application code runs a single line.
• Attribution: DEV#POPPER RAT family (DPRK-nexus, developer-targeting)
• Stable release versions of @joyfill packages are not confirmed affected; the attack used beta version strings

What to do

1. Search your dependency files now. Scan package.json, package-lock.json, and yarn.lock for @joyfill/layouts and @joyfill/components. Version ranges using ^, ~, or bare pre-release tags could have pulled these in automatically.
2. Remove and re-lock. Uninstall the compromised packages, pin explicit clean versions if @joyfill is a legitimate dependency, and regenerate lock files from a clean machine.
3. Assume compromise on any machine that ran them. Import-time execution means the RAT fired the moment node loaded the module — during npm install, test runs, or any build step requiring the package. If these versions ran on a system, that system may have an active remote access channel.
4. Rotate credentials. Any API keys, tokens, SSH keys, or environment variables accessible on an affected machine or runner should be rotated immediately. Assume the attacker can see everything the process could reach.
5. Reimage self-hosted runners. Ephemeral hosted runners (GitHub Actions, GitLab SaaS) are lower risk once the job ends — but verify no secrets leaked through environment variables. Self-hosted runners that installed either package should be reimaged, not just cleaned.

Priority call

DEV#POPPER is a persistent, developer-focused threat actor operating out of North Korea. This group has run similar operations before — the consistent pattern is legitimate-looking npm packages, often in beta, targeting developers because they’re the path to source code, CI/CD pipelines, and production infrastructure. Beta version strings are a deliberate evasion choice: they skip the scrutiny stable releases attract and install when teams use loose version pinning or enable pre-release installs.

If any @joyfill package is in your dependency tree, check your lock files now. Rotate first, audit second, reimage where needed.

Source: The Hacker News.