Joyfill npm Packages Hijacked: DEV#POPPER RAT Malware

Two popular npm packages from Joyfill—@joyfill/components and @joyfill/pdf—were compromised and weaponized with DEV#POPPER RAT malware. The malicious versions executed upon installation, establishing persistent backdoor access to developer machines. The attack targeted the JavaScript supply chain, affecting developers who imported these packages into Node.js projects. Joyfill has since released clean versions, but organizations must audit their dependencies and scan for compromise indicators immediately.

Introduction

The npm ecosystem suffered another significant supply chain attack when attackers successfully hijacked two Joyfill packages, injecting them with DEV#POPPER Remote Access Trojan (RAT) malware. This sophisticated attack demonstrates the continuing vulnerability of open-source package repositories to account takeover and malicious code injection.

Unlike typosquatting attacks that rely on developer mistakes, this compromise targeted legitimate packages with established user bases. The malware activated automatically upon package installation or import, requiring no additional user interaction beyond normal development workflows. This attack vector makes it particularly dangerous, as developers trust established packages and rarely scrutinize routine dependency updates.

The incident highlights critical weaknesses in package repository security and the need for enhanced verification mechanisms in software development pipelines.

Background & Context

Joyfill provides JavaScript libraries for PDF manipulation and UI components, commonly used in web applications requiring document handling capabilities. The compromised packages had accumulated thousands of downloads before the malicious versions were detected and removed.

DEV#POPPER represents an emerging class of developer-targeted malware specifically designed to compromise software development environments. Unlike traditional RATs that target end-users, DEV#POPPER focuses on gaining access to source code repositories, environment variables containing API keys, cloud credentials, and CI/CD pipelines.

The attack followed a familiar pattern seen in recent npm supply chain compromises:

• Attackers gained unauthorized access to the legitimate package maintainer’s npm account
• Malicious versions were published that appeared as routine updates
• The payload executed during the package installation process
• Persistence mechanisms ensured continued access even after package removal

Previous incidents involving packages like ua-parser-js, coa, and rc demonstrate this attack methodology’s effectiveness and the significant challenge of defending against supply chain compromises.

Technical Breakdown

The compromised versions of @joyfill/components and @joyfill/pdf contained obfuscated JavaScript code embedded within seemingly legitimate package files. Analysis reveals several sophisticated techniques:

Installation Trigger Mechanism

The malicious code executed via npm lifecycle scripts, particularly the preinstall and postinstall hooks:

{
  "scripts": {
    "postinstall": "node ./lib/setup.js"
  }
}

Payload Delivery

The setup.js file contained heavily obfuscated code that decoded and executed the DEV#POPPER RAT payload. Deobfuscation revealed multi-stage loading:

// Simplified representation of obfuscated code structure
const payload = Buffer.from(encodedString, 'base64');
eval(payload.toString('utf-8'));

DEV#POPPER RAT Capabilities

Once executed, the malware established the following functionality:

• Command and Control (C2): Established encrypted WebSocket connections to attacker-controlled servers
• Credential Harvesting: Scanned for .env files, .aws/credentials, SSH keys, and Git configuration
• Code Exfiltration: Monitored and uploaded source code from active development directories
• Persistence: Created system-level scheduled tasks and startup entries
• Keylogging: Captured keystrokes within terminal sessions and code editors
• Lateral Movement: Attempted to locate and compromise other development machines on the network

C2 Communication

The RAT communicated with hardcoded domains using TLS-encrypted channels:

hxxps://dev-analytics[.]cloud/api/telemetry
hxxps://package-metrics[.]dev/collect

These domains were registered shortly before the attack, using privacy-protected WHOIS records and hosted on bulletproof infrastructure.

Impact & Risk Assessment

Immediate Impact

Organizations and developers who installed affected versions face severe compromise scenarios:

• Credential Theft: API keys, cloud credentials, and authentication tokens likely exfiltrated
• Source Code Exposure: Proprietary code and intellectual property potentially stolen
• Supply Chain Propagation: Compromised credentials could enable attacks on downstream systems
• Data Breach Risk: Access to development environments often provides paths to production systems

Affected Versions

@joyfill/components: 1.2.34 - 1.2.38
@joyfill/pdf: 2.1.15 - 2.1.19

Risk Severity: CRITICAL

The combination of automatic execution, developer targeting, and credential access capabilities warrants maximum severity classification. Development environments typically contain elevated privileges and access to critical infrastructure.

Blast Radius

Estimating impact requires considering:

• Direct installations on developer workstations
• CI/CD pipeline executions that pulled affected versions
• Docker images built with compromised packages
• Deployed applications that may contain dormant malicious code

Vendor Response

Joyfill responded rapidly upon discovery of the compromise:

Immediate Actions Taken

• Malicious package versions removed from npm registry within 2 hours of confirmation
• Security advisory published to GitHub and npm
• Clean versions released (@joyfill/components v1.2.39, @joyfill/pdf v2.1.20)
• npm account credentials rotated and multi-factor authentication enforced
• Code signing implementation initiated for future releases

Official Statement

Joyfill acknowledged the account compromise and confirmed that the malicious code was not authored by their development team. They partnered with npm security team for forensic analysis and implemented enhanced security controls.

The npm security team deprecated affected versions and added warning flags, though already-installed packages require manual intervention for removal.

Mitigations & Workarounds

Immediate Response Steps

Organizations must take urgent action if potentially affected:

1. Identify Affected Systems

# Search for compromised packages in package.json
find . -name "package.json" -exec grep -l "@joyfill/components\|@joyfill/pdf" {} \;

# Check installed versions
npm list @joyfill/components @joyfill/pdf

2. Remove Compromised Packages

npm uninstall @joyfill/components @joyfill/pdf
rm -rf node_modules
npm cache clean --force
npm install

3. Credential Rotation

Immediately rotate all credentials accessible from affected systems:

• API keys and access tokens
• Cloud provider credentials (AWS, Azure, GCP)
• Database passwords
• SSH keys
• Git repository credentials
• NPM tokens

4. System Forensics

# Check for suspicious scheduled tasks (Linux)
crontab -l
systemctl list-timers

# Check for unusual processes
ps aux | grep -i node

# Review recent network connections
netstat -tupn | grep ESTABLISHED

5. Update to Safe Versions

npm install @joyfill/components@latest
npm install @joyfill/pdf@latest

Detection & Monitoring

Indicators of Compromise (IOCs)

Network-based indicators:

dev-analytics[.]cloud
package-metrics[.]dev
185.220.101.XX (C2 IP range)

File-based indicators:

~/.config/system-monitor/telemetry.db
/tmp/.npm-cache-handler
.node-persistent-config

Detection Queries

For organizations with EDR/XDR solutions:

# Suspicious network connections from node processes
ProcessName = "node" AND 
DestinationDomain CONTAINS "dev-analytics" OR "package-metrics"

# Unexpected scheduled task creation
EventID = 4698 AND 
TaskContent CONTAINS "node"

SIEM Detection Rules

- title: DEV#POPPER RAT Network Activity
  detection:
    selection:
      destination_domain:
        - 'dev-analytics.cloud'
        - 'package-metrics.dev'
      source_process: 'node'
    condition: selection
  level: critical

Best Practices

Supply Chain Security Hardening

1. Dependency Verification

# Enable npm audit in CI/CD
npm audit --audit-level=moderate

# Use package-lock.json integrity checking
npm ci

2. Implement Software Composition Analysis (SCA)

Deploy tools like Snyk, Socket, or Phylum to monitor dependencies:

# GitHub Actions example
name: Security Scan
  uses: snyk/actions/node@master
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

3. Least Privilege Development

• Separate development credentials from production
• Use short-lived tokens for cloud access
• Implement secrets management solutions (Vault, AWS Secrets Manager)

4. Network Segmentation

Isolate development networks from production infrastructure and implement egress filtering.

5. Package Pinning

{
  "dependencies": {
    "@joyfill/components": "1.2.33",
    "@joyfill/pdf": "2.1.14"
  }
}

Use exact versions rather than semver ranges for critical dependencies.

6. Registry Mirroring

Consider using private npm registries with security scanning:

npm config set registry https://registry.internal.company.com/

Key Takeaways

• Supply chain attacks remain highly effective against modern development workflows, requiring zero user interaction beyond normal package installation
• Developer environments are high-value targets containing credentials and access to critical infrastructure
• Automatic execution mechanisms in package managers create significant attack surface
• Rapid detection and response are critical—organizations must maintain updated dependency inventories
• Defense-in-depth strategies including credential rotation, network monitoring, and least privilege access are essential
• Trust verification cannot rely solely on package popularity or legitimacy; continuous monitoring is required
• Incident response plans must specifically address supply chain compromise scenarios

Organizations must treat development environments with the same security rigor as production systems, implementing comprehensive monitoring, access controls, and incident response capabilities specifically designed for supply chain threats.

References

• npm Security Advisory: Joyfill Package Compromise
• DEV#POPPER Malware Analysis – Threat Intelligence Report
• npm Package Lifecycle Scripts Documentation
• MITRE ATT&CK: T1195.002 – Compromise Software Supply Chain
• NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management
• Sonatype 2024 State of the Software Supply Chain Report
• CISA: Defending Against Software Supply Chain Attacks

Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/