"This is a redundant delivery branch, not a harmless fallback," Socket explained.
Affected packages and how the implant activates
Two beta release versions in the @joyfill namespace were found to contain an import-time JavaScript implant that executes immediately when Node.js loads the CommonJS package entry point. The compromised builds are:
- @joyfill/layouts@0.1.2-2773.beta.0
- @joyfill/components@4.0.0-rc24-2773-beta.4
Unlike malicious packages that rely on npm lifecycle hooks, the implant runs at load time inside any process that requires the package. Socket, the application security company that analyzed the packages, reported that the malicious code was present "at bundle time" and that both malicious versions appear to have been published by the same npm identity using Node.js 18.20.0 and npm 10.5.0. Socket also said it is not yet clear whether the source-code injection happened via a compromised developer workstation, source repository, CI environment, or publishing credentials.
Blockchain-based resolver and links to PolinRider
The implant uses a multi-blockchain dispatch to resolve encrypted payloads. When the package is loaded it attempts to obtain a Binance Smart Chain (BSC) transaction hash from the latest outbound transaction of a hard-coded Tron address. If that step fails, the code queries an Aptos account as a fallback, fetches the relevant BSC transaction, decrypts JavaScript embedded there, and executes it. Socket noted the use of Tron, Aptos, and BNB Smart Chain (BSC) in tandem.
Socket observed that this tiered, multi-blockchain resolver structure has been linked to a threat cluster tracked as PolinRider, which is assessed to be related to Contagious Interview. The blockchain-based approach provides operational resilience and lets attackers change payloads without publishing new npm versions.
Two delivery branches and their payloads
The implant follows two parallel execution paths. The in-process branch recovers a roughly 77 KB JavaScript payload that Socket says bears similarities to the DEV#POPPER malware family; that loader uses the blockchain resolution method to retrieve a second-stage payload named "clientCode."
The secondary branch launches a detached Node.js process that requests a separate boot payload from 23.27.13[.]43, decrypts the response, and evaluates the returned code. Socket emphasized that the detached process is not a harmless fallback: as quoted above, it is a redundant delivery branch that can continue running after a build, test, or CLI command exits.
Capabilities: clientCode RAT, Python infostealer, and data targeted
The final recovered "clientCode" payload is heavily obfuscated and operates as a Node.js remote-access trojan (RAT). Socket enumerated capabilities and behaviors, including:
- Uploading files to a configured upload host
- Retrieving additional JavaScript
- Collecting basic host details and sending status check-ins
- Establishing a Socket.IO remote-control channel and executing supplied JavaScript or shell commands
- Reading clipboard contents via PowerShell on Windows, pbpaste on macOS, and xclip/xsel on Linux
- Avoiding execution on hosts whose names indicate CI or sandboxed environments (github-runner, buildbot, buildkitsandbox, and microsoft-standard-WSL2)
Socket also identified the detached process as capable of running one of two payloads: the clientCode RAT or a Python infostealer assessed to be an iteration of OmniStealer (eSentire first detailed OmniStealer in April). The malware family can harvest a wide range of data from compromised hosts, including environment and host information; Windows Credential Manager and Linux Secret Service data; Chromium and Firefox browser data; browser extension storage for wallets and password managers; Git credentials and GitHub CLI configuration; GitHub Desktop logs; and Microsoft Visual Studio Code storage.
Attribution and prior related campaigns
Socket told The Hacker News that the recent joyfill compromises and an earlier set of malicious npm packages known as ViteVenom are connected to the same ongoing operation by North Korean threat actors, rather than being separate campaigns. Earlier this month, Checkmarx and OpenSourceMalware flagged the ViteVenom cluster, which used the same tiered blockchain-based command-and-control infrastructure to deliver a RAT capable of reverse shell, credential harvesting, file exfiltration, and persistent backdoor injection.
What developers, CI runners, and procurement teams should do now
Socket warned that "The @joyfill/layouts release should be treated as capable of arbitrary code execution in the context of any process that loads it," explicitly naming development environments, CI runners, test tooling, server-side rendering, and builds. Developers who have installed the affected versions are advised to remove them from lockfiles, caches, internal mirrors, build images, and deployment artifacts, pin to a verified version, and rotate credentials from the affected Node.js process.
Because the malware can persist independently in a detached process and because the blockchain-based resolver allows payloads to change without republishing, organizations should assume that any environment that executed the compromised packages could have been used to deliver multiple, evolving payloads.
