Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan

Two npm beta releases in the @joyfill namespace were compromised with an import-time JavaScript implant that uses blockchain transactions on Tron, Aptos, and BNB Smart Chain to retrieve encrypted payloads. The malicious code leads to a 77 KB Node.js remote-access trojan identified as DEV#POPPER, which establishes Socket.IO connections for remote control and can execute commands, upload files, read clipboard data, and persist through developer tools. A parallel execution branch downloads additional payloads including an 82 KB Python infostealer assessed to be OmniStealer, targeting browser credentials, Git configurations, and wallet extensions. The compromise affected @joyfill/layouts version 0.1.2-2773.beta.0 and @joyfill/components version 4.0.0-rc24-2773-beta.4, with approximately 16,000 weekly downloads. The loader exhibits exact code overlap with the PolinRider family and DEV#POPPER operations.

• A new version of the MacSync macOS stealer targets crypto enthusiasts and developersMalware2026-09-24
• PolinRider Spreads Through Compromised GitHub Accounts and PackagistMalware2026-09-18
• Inside ICMacOS: From an Infostealer to a Persistent RATMalware2026-10-27
• Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens StumblesMalware2026-10-26
• Infostealer riding the AI TrainMalware2026-10-23