Two beta-release packages in the @joyfill npm namespace have been compromised to silently install a remote access trojan (RAT) the moment a Node.js application imports them. Security researchers at Socket identified the affected packages as @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4. Unlike many malicious packages that run malware through npm lifecycle hooks, these execute their payload the instant Node.js loads the library’s CommonJS entry point — meaning there is no install-time warning, only a quiet compromise at runtime.
The implant uses a multi-blockchain resolver to receive its commands: it fetches an encrypted payload by reading Tron, Aptos, and BNB Smart Chain (BSC) transactions, making the C2 channel harder to block with traditional network filters. Once decrypted, the payload is consistent with the DEV#POPPER malware family, associated with the PolinRider / Contagious Interview threat cluster. Two execution branches run in parallel — one inside the current process and one as a detached Node.js subprocess — delivering reverse shell access, credential harvesting, file exfiltration, and persistent backdoor injection.
How to check if you’re affected
Affected versions are the specific beta releases listed above. Run npm ls @joyfill/layouts @joyfill/components in any Node.js project to check which versions are installed. If either matches 0.1.2-2773.beta.0 or 4.0.0-rc24-2773-beta.4, treat the host as compromised, rotate all credentials accessible to that process, and downgrade to a clean release version. The stable releases are not known to be affected.