Two Joyfill npm Packages Found Delivering DEV#POPPER Malware

Researchers identified two compromised joyfill npm beta packages that execute at import time to install a DEV#POPPER Node.js RAT capable of remote control, command execution, file exfiltration, and persistence; the loader fetches encrypted payloads via Tron, Aptos, and BNB Smart Chain transactions enabling dynamic updates, and additional payloads included a Python credential stealer. The packages were published 28 July 2026, affect developer/CI/production environments, and researchers recommend removing the affected releases, isolating impacted systems, rotating credentials, and monitoring for unusual blockchain RPC activity.