Two beta packages in the @joyfill npm namespace have been compromised to execute a remote access trojan (RAT) the instant they are imported into a Node.js project, marking a stealthy evolution in supply-chain attacks. The malicious versions, @joyfill/layouts 0.1.2-2773.beta.0 and @joyfill/components 4.0.0-rc24-2773-beta.4, contain an implant that activates at the very start of the development process.
According to a report from The Hacker News, the attack leverages an import-time JavaScript payload. This code decrypts and runs hidden instructions to deliver malware linked to the DEV#POPPER threat group. Unlike attacks that trigger during build or runtime, this method compromises the environment as soon as a developer includes the package, bypassing many standard security scans that only check dependencies after installation.
The focus on pre-release versions is a deliberate strategy. Beta and release-candidate packages often receive less security review than stable releases, and their use within a trusted namespace can lower a developer's guard. This provides an ideal vector for attackers aiming to infiltrate development machines and CI/CD pipelines—high-value targets that offer direct access to credentials, source code, and cloud tokens.
The full scope of the breach is not yet clear. The initial compromise vector for the @joyfill maintainer accounts remains unknown. Organizations that may have used the affected beta versions will need to examine installation logs and system telemetry to assess exposure.
This incident highlights the need for stricter governance around pre-release dependencies. Teams should explicitly review and approve any beta or RC packages before use. Runtime monitoring for unexpected network activity during installation can catch implants early, while integrity verification against registry-provided checksums ensures package authenticity.
The attack underscores a critical shift: simply importing a module can now be a point of compromise. As the JavaScript ecosystem continues to rely on open-source components, developers must treat even temporary dependencies with rigorous security scrutiny. Affected users are advised to audit recent changes, rotate any potentially exposed credentials, and enforce policies that elevate the review process for non-stable packages.
@joyfill npm 命名空間內的兩個測試版軟件包遭入侵，能在匯入 Node.js 專案時立即執行遠端訪問木馬（RAT），標誌著供應鏈攻擊的一種隱蔽演進。惡意版本 @joyfill/layouts 0.1.2-2773.beta.0 和 @joyfill/components 4.0.0-rc24-2773-beta.4 包含的植入程序會在開發過程一開始便啟動。
根據 The Hacker News 的報導，該攻擊利用匯入時的 JavaScript 有效載荷。這段代碼會解密並執行隱藏指令，以投放與 DEV#POPPER 威脅組織有關的惡意軟件。不同於在編譯或執行時觸發的攻擊，這種方法在開發人員加入該套件時便已入侵開發環境，從而繞過許多僅在安裝後檢查依賴項的標準安全掃描。
專注於預先發布版本是一項經過深思熟慮的策略。測試版和候選發布版本通常比穩定版本受到較少的安全審查，而其在受信任的命名空間內的使用，可能降低開發人員的戒心。這為旨在滲透開發機器與 CI/CD 流水線的攻擊者提供了理想向量，這些都是高價值目標，可直接獲取憑證、原始碼及雲端代幣。
此次外洩的全部範圍尚不明確。@joyfill 維護者帳戶的初始入侵向量仍然未知。可能使用過受影響測試版的組織，需要檢查安裝日誌和系統遙測數據以評估暴露程度。
此事件突顯了對預先發布依賴項實施更嚴格管治的必要性。團隊在使用任何測試版或 RC 套件前，應明確審查並批准。在安裝過程中對意外網絡活動進行執行時監控，可及早發現植入程序，而與註冊表提供的校驗和進行完整性驗證，則確保了軟件包的真實性。
此次攻擊凸顯了一個關鍵轉變：僅僅匯入一個模組現在也可能成為入侵點。隨著 JavaScript 生態系統繼續依賴開源組件，開發人員必須對即使是臨時的依賴項也進行嚴格的安全審查。建議受影響的用戶審計最近的更改，輪換任何可能已暴露的憑證，並實施政策，提升對非穩定版本的審查流程。