LOWSupply Chain
Global

Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

·Source: The Hacker News

Updated:

Executive Summary

Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan (RAT) associated with the DEV#POPPER malware family. The list of affected packages is as follows - @joyfill/layouts@0.1.2-2773.beta.0 @joyfill/components@4.0.0-rc24-2773-beta.4 The two packages "contain an import-time JavaScript implant that resolves encrypted code

Analysis

Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan (RAT) associated with the DEV#POPPER malware family. The list of affected packages is as follows - @joyfill/layouts@0.1.2-2773.beta.0 @joyfill/components@4.0.0-rc24-2773-beta.4 The two packages "contain an import-time JavaScript implant that resolves encrypted code

Indicators of Compromise (1)

Email (1)
layouts@0.1.2-2773.beta
Source Attribution

Originally published by The Hacker News on Jul 29, 2026.

Related Threats

MEDIUMSupply Chain

When AppSec Scanners Become a Supply Chain Attack Vector

New research shows how security scanners embedded in the software supply chain can be attacked to serve as a foothold for downstream attacks.

Dark Reading
MEDIUMSupply Chain

US Bans Foreign-Made Humanoid Robots, Targeting China Over National Security

The agency said imports of advanced robots pose cybersecurity and other national security risks. The post US Bans Foreign-Made Humanoid Robots, Targeting China Over National Security appeared first on SecurityWeek .

SecurityWeek
MEDIUMSupply Chain

2026 Minimum Elements for a Software Bill of Materials (SBOM)

<p>CISA, the National Security Agency, the Federal Bureau of Investigation, and international partners released joint guidance,&nbsp;<a href="https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf">2026 Minimum Elements for a Software Bill of Materials (SBOM)</a>, that updates and replaces the minimum elements for an SBOM published by the National Telecommunicati

CISA Advisories