Compromised Joyfill npm Packages Deliver DEV#POPPER-Linked RAT via Blockchain C2
Summary
Socket reports that two compromised Joyfill npm packages run malware on import, using blockchain-based payload retrieval to deliver a RAT and a separate branch associated with an OmniStealer-like infostealer. Developers are advised to remove the packages and rotate keys
Key points
- The affected versions are @joyfill/[email protected] and @joyfill/[email protected]; their implant runs when Node.js loads the CommonJS entry point.
- The malware uses Tron transactions, with an Aptos fallback, to retrieve BNB Smart Chain transaction data and resolve encrypted JavaScript payloads.
- A detached Node.js process can continue after the importing build, test, or CLI process exits; it requests a separate boot payload from 23.27.13[.]43.
- The recovered RAT can execute JavaScript or shell commands, upload files, read clipboard data, collect host details, and establish remote control; it avoids several development and sandbox hostnames.
- A separate Python infostealer, assessed as an OmniStealer iteration, can collect credentials and data from browsers, wallet and password-manager extensions, Git tools, and developer applications.
- Socket linked the packages to the ViteVenom activity and assessed both as part of an ongoing operation by North Korean threat actors; the source of the package code injection is unclear.
- Developers are advised to remove affected versions from lockfiles, caches, mirrors, build images, and deployment artifacts, pin a verified version, and rotate credentials accessible to the affected Node.js process.
Article Details
- Attack Vectors
- Compromised @joyfill/[email protected] and @joyfill/[email protected] npm packages execute an implant when Node.js loads their CommonJS entry point.
- The implant retrieves and executes encrypted payloads using transaction data from Tron, Aptos, and BNB Smart Chain.
- A detached Node.js process requests a separate boot payload from 23.27.13[.]43, decrypts it, and evaluates it.
- The recovered RAT can execute supplied JavaScript or shell commands, upload files, retrieve additional JavaScript, collect host details, and read clipboard data.
- A Python infostealer delivered through the detached branch can collect host and environment information, credentials, browser data, wallet and password-manager extension storage, and developer-tool data.
- Defensive Notes
- Remove affected package versions from lockfiles, caches, internal mirrors, build images, and deployment artifacts.
- Pin to a verified package version.
- Rotate credentials from affected Node.js processes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 23[.]27[.]13[.]43 | IP address contacted by the detached Node.js process to retrieve a separate boot payload. |
MITRE ATT&CK
T1005 · Data from Local SystemThe Python infostealer collects host and environment information, credentials, browser data, extension storage, and developer-tool data from compromised hosts.T1027 · Obfuscated Files or InformationThe article says the blockchain-resolved code is decrypted and the final clientCode payload is heavily obfuscated.T1059.001 · PowerShellThe RAT uses PowerShell on Windows to read clipboard data.T1059.004 · Unix ShellThe final recovered code can execute supplied shell commands.T1059.007 · JavaScriptThe package implant and recovered payload execute JavaScript, including code retrieved from blockchain transactions and evaluated by the detached process.T1105 · Ingress Tool TransferThe implant retrieves JavaScript payloads through blockchain transaction data and the detached process fetches a boot payload from 23.27.13[.]43.T1115 · Clipboard DataThe RAT reads clipboard data using PowerShell on Windows, pbpaste on macOS, and xclip or xsel on Linux.
Threat Actors
Malware
clientCodeloader that employs the blockchain resolution method to retrieve a second-stage malware named “clientCode.” The detached process, on the other hand, queries the aforementioned IP address to obtain and executeDEV#POPPERTwo beta npm packages in the @joyfill namespace were compromised to deliver a DEV#POPPER-associated remote access trojan using import-time JavaScript implants and blockchain-based payload retrieval.OmniStealerThe activity is linked to the same North Korean operation behind ViteVenom and also involved a Python infostealer tied to OmniStealer.