Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan (RAT) associated with the DEV#POPPER malware family.
The list of affected packages is as follows -
- @joyfill/layouts@0.1.2-2773.beta.0
- @joyfill/components@4.0.0-rc24-2773-beta.4
The two packages "contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions," Socket said in an analysis.
Unlike other malicious packages that are triggered via an npm lifecycle hook, the implant delivered as part of the JavaScript libraries runs when Node.js loads the CommonJS package entry point.
It's worth noting that the use of a multi-blockchain resolver structure comprising Tron, Aptos, and BNB Smart Chain (BSC) has been linked to a threat cluster tracked as PolinRider, which is assessed to be related to Contagious Interview.
Earlier this month, Checkmarx and OpenSourceMalware highlighted a set of malicious npm packages collectively referred to as ViteVenom targeting the Vite frontend tooling ecosystem using the same tiered blockchain-based command-and-control (C2) infrastructure to deliver a RAT with reverse shell, credential harvesting, file exfiltration, and persistent backdoor injection capabilities.
The implant consists of two parallel sequences of actions -
- An in-process branch that leads to a recovered 77 KB JavaScript payload with similarities to the DEV#POPPER malware family
- A secondary branch that launches a detached Node.js process, requests a separate boot payload from 23.27.13[.]43, decrypts the response, and evaluates it
Once the package is loaded, it initiates a blockchain-based dispatch that obtains a BSC transaction hash from the latest outbound transaction of a hard-coded Tron address. If this step fails, it queries an Aptos account as a fallback to fetch the BSC transaction and, from it, decrypt and extract the JavaScript code and execute it.
Both the in-process and detached branches use a distinct set of wallet addresses, accounts, and transactions for Tron, Aptos, and BSC. The use of blockchain also means that it offers operational resilience and makes it possible to switch payloads without having to publish a new version of the packages.
The first in-process payload is a JavaScript loader that employs the blockchain resolution method to retrieve a second-stage malware named "clientCode." The detached process, on the other hand, queries the aforementioned IP address to obtain and execute JavaScript code.
"This is a redundant delivery branch, not a harmless fallback," Socket explained. "It is detached from the importing Node.js process and can continue after a build, test, or CLI command exits."
The final "clientCode" payload is heavily obfuscated and functions as a Node.js RAT with the following features, while avoiding execution on development, CI, or sandboxed machines with the hostnames github-runner, buildbot, buildkitsandbox, and microsoft-standard-WSL2 -
- Upload files to the configured upload host
- Retrieve additional JavaScript
- Collect basic host details
- Send status check-in messages
- Read clipboard data through PowerShell on Windows, pbpaste on macOS, and xclip or xsel on Linux
Two payloads have been associated with the detached process: the "clientCode" RAT and a Python infostealer that can harvest a wide range of data from compromised hosts. It's assessed to be an iteration of the OmniStealer malware, details of which were first highlighted by eSentire earlier this April.
The data collected by the malware is below -
- Environment and host information
- Windows Credential Manager and Linux Secret Service data
- Chromium and Firefox browser data
- Browser extension storage for wallets and password managers
- Git credentials
- GitHub CLI configuration
- GitHub Desktop logs
- Microsoft Visual Studio Code storage
Socket told The Hacker News that both ViteVenom and the latest collection of npm packages are connected to the same ongoing operation by North Korean threat actors, rather than representing separate campaigns.
According to the application security company, both malicious versions are said to have been published by the same npm identity using Node.js 18.20.0 and npm 10.5.0, with the code present at bundle time. That said, it's currently not clear if this source code injection was achieved following a compromise of a developer workstation, source repository, CI environment, or publishing credentials.
Developers who have installed the affected versions are advised to remove them from lockfiles, caches, internal mirrors, build images, and deployment artifacts, pin to a verified version, and rotate credentials from the affected Node.js process.
"The @joyfill/layouts release should be treated as capable of arbitrary code execution in the context of any process that loads it," Socket said. "This includes development environments, CI runners, test tooling, server-side rendering, and builds."
"The final recovered code can collect host information, establish a Socket.IO remote-control channel, execute supplied JavaScript or shell commands, upload files, read clipboard data, and modify files belonging to developer tools."
