Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan (RAT) associated with the DEV#POPPER malware family. The list of affected packages is as follows - @joyfill/layouts@0.1.2-2773.beta.0 @joyfill/components@4.0.0-rc24-2773-beta.4 The two packages "contain an import-time JavaScript implant that resolves encrypted code

The article reports that specific beta versions of two npm packages in the @joyfill namespace (@joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4, with additional nearby betas also affected) were compromised to include an import-time JavaScript implant that retrieves and runs a DEV#POPPER family remote access trojan (RAT), enabling arbitrary code execution in any Node.js process that loads them.[1][2][3] The malware uses blockchain transactions as a command-and-control lookup, establishes remote-control channels, and can stage credential theft, meaning any development workstation or CI/CD runner that imported these versions should be treated as potentially fully compromised.[2][3] From a RealGround perspective, this is an AI supply chain risk because compromised JavaScript dependencies can silently infect environments used to build, test, or deploy AI agents and models, corrupt SBOMs, and exfiltrate credentials or code that underpin AI systems. Organizations should tighten dependency governance (pin and audit npm versions, maintain SBOMs, and monitor for anomalous package behavior) and consider continuous red teaming of AI development and deployment p