Back to Intelligence

Compromised @joyfill npm Packages Delivering DEV#POPPER RAT — Detection and Remediation Guide

SA
Security Arsenal Team
July 29, 2026
8 min read

Introduction

A concerning supply chain attack is currently targeting the npm ecosystem, with two packages in the @joyfill namespace confirmed to be compromised. The affected packages, @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4, contain a malicious JavaScript implant that executes at import time, delivering a Remote Access Trojan (RAT) associated with the DEV#POPPER malware family.

This attack demonstrates the continued threat of software supply chain compromises, where legitimate packages are weaponized to deliver malware to development environments. The implant operates silently during package importation, making it particularly dangerous as it can execute before any security controls are triggered. Given the prevalence of npm in modern development workflows, organizations using Node.js should immediately assess their exposure and implement the detection measures outlined in this guide.

Technical Analysis

Affected Products and Versions

The following npm packages in the @joyfill namespace have been compromised:

  • @joyfill/layouts@0.1.2-2773.beta.0
  • @joyfill/components@4.0.0-rc24-2773-beta.4

These are beta release versions that may have been adopted by organizations using cutting-edge features from the Joyfill library, which provides form-building components and layouts for web applications.

Attack Vector

The attack operates through an import-time JavaScript implant embedded within the compromised packages. When the package is imported into a Node.js application, the implant triggers immediately, before any application logic executes. This timing is significant as it allows the malware to establish persistence and potentially compromise the development environment before security monitoring can detect the unusual behavior.

Once executed, the implant resolves encrypted code that delivers the DEV#POPPER RAT. This malware family provides attackers with remote access capabilities, including command execution, file manipulation, and data exfiltration. The encryption of the payload serves as an obfuscation technique, making static analysis of the package more difficult and allowing the implant to evade basic signature-based detection.

Exploitation Status

This is currently an active threat with confirmed malicious packages available in the npm registry. The compromised packages represent a supply chain attack vector that can affect any development environment or CI/CD pipeline that installs these versions. The use of beta releases suggests the attackers may be targeting development or testing environments where security controls are often less rigorous than production environments.

The DEV#POPPER RAT associated with this campaign provides full remote access capabilities, meaning compromised systems could be used for lateral movement, credential theft, or as staging points for further attacks. Organizations using these packages should assume potential compromise until verified otherwise.

Detection & Response

The following detection measures can help identify exposure to this threat and potential compromise.

YAML
---
title: npm Package Installation of Compromised @joyfill Packages
id: 8f3c5d1a-e4b7-4a2f-9c8d-1e5f7a9b2c3e
status: experimental
description: Detects installation of compromised @joyfill npm packages associated with DEV#POPPER RAT delivery
references:
  - https://thehackernews.com/2026/07/two-compromised-joyfill-npm-packages.html
author: Security Arsenal
date: 2026/07/14
tags:
  - attack.initial_access
  - attack.supply_chain
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\npm.exe'
    CommandLine|contains:
      - '@joyfill/layouts@0.1.2-2773.beta.0'
      - '@joyfill/components@4.0.0-rc24-2773-beta.4'
  condition: selection
falsepositives:
  - Legitimate installation of Joyfill packages for testing purposes (should be verified)
level: critical
---
title: Node.js Process Spawning Suspicious Child Processes After Import
id: 7e4d6c2b-f5a8-4b3e-9d7c-2f6a8b0c1d3e
status: experimental
description: Detects Node.js processes spawning suspicious child processes potentially indicating DEV#POPPER RAT activity
references:
  - https://thehackernews.com/2026/07/two-compromised-joyfill-npm-packages.html
author: Security Arsenal
date: 2026/07/14
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.exe'
  selection_child:
    Image|contains:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate build scripts or development tools
level: high
---
title: Node.js Process with Suspicious Network Connections
id: 6d3c5b1a-d4a7-4c2e-8d7b-3e5a9c0b2d3f
status: experimental
description: Detects Node.js processes establishing suspicious network connections potentially indicating C2 activity
references:
  - https://thehackernews.com/2026/07/two-compromised-joyfill-npm-packages.html
author: Security Arsenal
date: 2026/07/14
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\node.exe'
    DestinationPort|startswith:
      - '443'
      - '80'
      - '8080'
    Initiated: 'true'
  filter:
    DestinationHostname|contains:
      - 'npmjs.com'
      - 'github.com'
      - 'registry.npmjs.org'
  condition: selection and not filter
falsepositives:
  - Legitimate network traffic from Node.js applications
level: medium
KQL — Microsoft Sentinel / Defender
// Hunt for installations of compromised @joyfill packages
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoOriginalFileName == "npm.exe" or ProcessVersionInfoOriginalFileName == "node.exe"
| where ProcessCommandLine has "@joyfill/layouts@0.1.2-2773.beta.0" 
   or ProcessCommandLine has "@joyfill/components@4.0.0-rc24-2773-beta.4"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

// Look for suspicious Node.js activity potentially related to DEV#POPPER RAT
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessVersionInfoOriginalFileName has "node.exe"
| where ProcessVersionInfoOriginalFileName in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")
| extend IsAnomalous = iff(ProcessCommandLine contains "@joyfill", true, false)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, IsAnomalous
| order by Timestamp desc

// Monitor for network connections from Node.js processes that might indicate RAT activity
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessVersionInfoOriginalFileName == "node.exe"
| where RemotePort in (443, 80, 8080, 8443)
| where RemoteUrl !contains "npmjs.com" and RemoteUrl !contains "github.com" and RemoteUrl !contains "registry.npmjs.org"
| project Timestamp, DeviceName, AccountName, RemoteUrl, RemotePort, RemoteIP, InitiatingProcessCommandLine
| order by Timestamp desc
VQL — Velociraptor
-- Hunt for compromised @joyfill packages in node_modules directories
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='/*/node_modules/@joyfill/layouts/package.')
-- Check for specific compromised versions in package.
WHERE parse_(data=read_file(filename=FullPath)).version =~ '0.1.2-2773.beta.0'

-- Hunt for compromised @joyfill/components package
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='/*/node_modules/@joyfill/components/package.')
-- Check for specific compromised versions in package.
WHERE parse_(data=read_file(filename=FullPath)).version =~ '4.0.0-rc24-2773-beta.4'

-- Look for suspicious Node.js processes with unusual command lines
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, Ctime
FROM pslist()
WHERE Name =~ "node"
  AND (CommandLine =~ "@joyfill" 
       OR CommandLine =~ "0.1.2-2773.beta.0" 
       OR CommandLine =~ "4.0.0-rc24-2773-beta.4")

-- Monitor for suspicious network connections from Node.js processes
SELECT Pid, RemoteAddress, RemotePort, Family, State, Type
FROM netstat()
WHERE Pid IN (
    SELECT Pid FROM pslist() 
    WHERE Name =~ "node"
  )
  AND (RemotePort IN (443, 80, 8080, 8443)
       OR Family =~ "TCP")
PowerShell
# Remediation script to detect and remove compromised @joyfill packages

# Function to check for and remove compromised @joyfill packages
function Remove-CompromisedJoyfillPackages {
    param (
        [string]$basePath = "."
    )
    
    $compromisedPackages = @{
        "@joyfill/layouts" = "0.1.2-2773.beta.0"
        "@joyfill/components" = "4.0.0-rc24-2773-beta.4"
    }
    
    $nodeModulesPath = Join-Path $basePath "node_modules"
    
    if (-not (Test-Path $nodeModulesPath)) {
        Write-Host "node_modules directory not found at $basePath"
        return
    }
    
    foreach ($package in $compromisedPackages.Keys) {
        $packagePath = Join-Path $nodeModulesPath $package
        
        if (Test-Path $packagePath) {
            $packageJsonPath = Join-Path $packagePath "package."
            
            if (Test-Path $packageJsonPath) {
                try {
                    $packageJson = Get-Content $packageJsonPath -Raw | ConvertFrom-Json
                    $installedVersion = $packageJson.version
                    
                    if ($installedVersion -eq $compromisedPackages[$package]) {
                        Write-Host "[ALERT] Compromised package found: $package@$installedVersion" -ForegroundColor Red
                        Write-Host "Removing package at $packagePath..."
                        
                        # Remove the compromised package directory
                        Remove-Item -Path $packagePath -Recurse -Force
                        Write-Host "Package removed successfully." -ForegroundColor Green
                        
                        # Log this incident
                        Write-Host "[INCIDENT] Compromised npm package detected and removed: $package@$installedVersion" >> ".\npm_security_incident.log"
                    } else {
                        Write-Host "[OK] Package $package installed with non-compromised version: $installedVersion" -ForegroundColor Green
                    }
                } catch {
                    Write-Host "Error reading package. for $package at $packageJsonPath" -ForegroundColor Yellow
                }
            }
        }
    }
}

# Function to recursively check all subdirectories for node_modules
function Search-ForCompromisedPackages {
    param (
        [string]$rootPath = "."
    )
    
    # Check current directory
    Remove-CompromisedJoyfillPackages -basePath $rootPath
    
    # Recursively check subdirectories
    Get-ChildItem -Path $rootPath -Directory -Recurse | ForEach-Object {
        if (Test-Path (Join-Path $_.FullName "package.")) {
            Write-Host "Checking project at $($_.FullName)..."
            Remove-CompromisedJoyfillPackages -basePath $_.FullName
        }
    }
}

# Execute the remediation
Write-Host "Starting scan for compromised @joyfill packages..." -ForegroundColor Cyan
Search-ForCompromisedPackages -rootPath "."
Write-Host "Scan completed." -ForegroundColor Cyan

Remediation

Immediate Actions

  1. Identify Exposure: Run the remediation script above across all development environments, CI/CD pipelines, and build systems to identify any instances of the compromised packages.

  2. Remove Compromised Packages: Immediately uninstall the affected package versions: bash

Bash / Shell
   npm uninstall @joyfill/layouts@0.1.2-2773.beta.0
   npm uninstall @joyfill/components@4.0.0-rc24-2773-beta.4

  1. Audit Development Systems: Conduct a thorough security audit of any development environment or build system where these packages were installed. The DEV#POPPER RAT may have established persistence mechanisms or exfiltrated sensitive data.

  2. Check for Lateral Movement: If compromised systems were connected to production environments, audit those systems for signs of lateral movement or credential compromise.

Long-term Protection

  1. Implement Package Pinning: Use package-lock. and npm shrinkwrap to ensure exact versions of dependencies are installed across all environments.

  2. Enable npm Audit: Regularly run npm audit in CI/CD pipelines to detect known vulnerabilities in dependencies.

  3. Implement SCA Tools: Deploy Software Composition Analysis (SCA) tools to monitor for vulnerabilities and malicious packages throughout the development lifecycle.

  4. Package Source Verification: Implement controls to verify the integrity and authenticity of npm packages before installation.

  5. Network Segmentation: Isolate development environments from production networks to limit the potential impact of supply chain attacks.

  6. Monitor for Anomalous Behavior: Implement endpoint detection and response (EDR) solutions with rules specifically targeting supply chain attack vectors and unusual process execution patterns from development tools.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub

incident-responseransomwarebreach-responseforensicsdfirnpmjoyfillsupply-chain-attackdev-popperrat

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action