On December 17, 2024, Socket identified two compromised packages in the @joyfill namespace: @joyfill/[email protected] and @joyfill/[email protected]. These versions deliver a remote access trojan from the DEV#POPPER malware family when imported into Node.js applications. The notable aspect of this incident isn't just another supply chain attack; it's the command-and-control infrastructure: a multi-blockchain resolver that queries Tron, Aptos, and BNB Smart Chain to retrieve execution instructions.
What Changed
The compromised packages mark a shift in malware delivery sophistication. Instead of hardcoding C2 domains or IP addresses that defenders can block, this malware uses public blockchains as distributed configuration stores. The resolver checks each blockchain in sequence until it finds valid instructions, then executes the payload. Socket and Checkmarx have linked this activity to North Korean threat actors, specifically the PolinRider threat cluster.
Your npm lockfile won't protect you here. The malicious code executes on import, before your application code runs. If you pulled either package during the compromise window, your development or build environment became a RAT endpoint.
Key Findings
Multi-blockchain resolvers provide operational resilience. The malware queries Tron first, then Aptos, then BNB Smart Chain. If defenders block one blockchain's RPC endpoints, the malware fails over to the next. This architecture eliminates single points of failure that traditional C2 takedowns rely on. You can't just null-route a domain or petition a registrar.
Package compromise timing matters more than you think. The affected versions used specific pre-release tags (beta.0 and rc24-2773-beta.4). Teams running automated dependency updates or using version ranges that include pre-release builds pulled malicious code without manual intervention. Your CI/CD pipeline became the infection vector.
Detection requires network-layer visibility. The malware makes HTTPS requests to public blockchain RPC endpoints. Your application firewall sees legitimate-looking API traffic to Tron nodes or BNB Chain infrastructure. Without packet inspection or allowlist enforcement, you won't catch the C2 handshake in your logs.
Blockchain immutability works against defenders. Once attackers write malicious instructions to a blockchain, you can't delete them. You can only block access to the RPC endpoints that read them. This means the payload configuration persists indefinitely, waiting for new victims to query it.
Pre-release versions bypass security assumptions. Many teams apply stricter review to production dependencies but treat beta or release candidate packages as lower risk. Attackers know this. Targeting pre-release versions increases the window between compromise and detection.
What This Means for Your Team
You need network egress controls that treat blockchain RPC endpoints as high-risk destinations. If your Node.js applications don't have legitimate reasons to query Tron, Aptos, or BNB Smart Chain, block those connections at the firewall. Don't wait for signature-based detection to catch up.
Your dependency verification process needs to validate package publishers, not just package names. The @joyfill namespace was compromised, meaning the packages came from an account with legitimate publishing rights. Namespace trust doesn't equal version trust. Check the publish timestamp, review the diff from the previous version, and verify the publisher's identity hasn't changed.
If you run builds in containers, those containers need egress filtering. A compromised package in your build environment can exfiltrate source code, environment variables, or credentials before your application ever reaches production. Treat build-time security with the same rigor as runtime security.
Action Items by Priority
Immediate (today): Search your package-lock.json and yarn.lock files for @joyfill/[email protected] and @joyfill/[email protected]. If found, assume compromise. Rotate all credentials accessible from that environment, review your Git history for unauthorized commits, and check for unexpected network connections in your build logs.
This week: Implement egress filtering rules that block connections to blockchain RPC endpoints unless explicitly required. Start with Tron (api.trongrid.io), Aptos (fullnode.mainnet.aptoslabs.com), and BNB Smart Chain (bsc-dataseed.binance.org). Expand the blocklist as new chains appear in threat intelligence.
This month: Add package publisher verification to your CI pipeline. Tools like Socket, Snyk, or npm audit can flag packages with recent publisher changes or unusual version patterns. Configure your pipeline to fail builds when it detects pre-release versions from publishers without established trust.
This quarter: Audit your dependency update policies. If you're automatically merging Dependabot or Renovate PRs for pre-release versions, you're accepting risk without review. Require manual approval for any version containing "beta", "rc", "alpha", or "canary" tags. The convenience isn't worth the exposure.
Ongoing: Monitor your build environments for unexpected network activity. Set up alerts for HTTPS connections to domains outside your approved vendor list. Blockchain RPC endpoints should trigger immediate investigation, not just logging.
