Malicious npm Packages Deliver DEV#POPPER RAT via Encrypted Code
Two beta versions of @joyfill npm packages have been compromised to deliver a remote access trojan (RAT) linked to the DEV#POPPER malware family.
Security researchers have identified a new threat targeting the Node.js ecosystem through compromised npm packages. Two beta versions within the @joyfill namespace, specifically @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4, have been found to contain malicious code.
These packages harbor an import-time JavaScript implant. This implant is designed to resolve encrypted code upon being imported into a Node.js environment. The decryption process reveals and executes a remote access trojan (RAT), which has been attributed to the known DEV#POPPER malware family. This sophisticated technique allows the malicious payload to remain hidden until the compromised package is actively used in a project.
The DEV#POPPER malware family is known for its capabilities in establishing persistent access to compromised systems, allowing attackers to conduct various malicious activities. These can include data theft, espionage, and further network infiltration. The use of encrypted code and an import-time execution mechanism highlights the evolving tactics employed by threat actors in supply chain attacks.
While the article specifies beta versions, it serves as a stark reminder of the inherent risks associated with consuming packages from public repositories, even those not yet considered stable releases. Developers often integrate beta or release candidate versions into their projects for early access to new features, inadvertently exposing themselves to such threats.
The compromise of these @joyfill packages underscores the ongoing challenges in securing the software supply chain. Attackers are increasingly targeting popular package managers like npm to distribute malware, leveraging the trust developers place in these ecosystems. The ease with which malicious code can be injected into seemingly legitimate packages poses a significant risk to the wider development community.
As of the disclosure, the exact scale of the compromise and the number of developers who may have inadvertently installed these malicious packages remain unclear. However, the nature of the DEV#POPPER RAT suggests that any compromised systems could be at risk of significant security breaches. Users are strongly advised to review their project dependencies and avoid using the identified beta versions of the @joyfill packages.
This incident follows a pattern of numerous supply chain attacks that have targeted the npm registry, with threat actors continuously finding new ways to inject malware into widely used libraries. The reliance on open-source software by a vast majority of developers makes such attacks particularly impactful, potentially affecting a broad range of applications and services.