🟠 High | Source: The Hacker News
Two beta-release npm packages in the @joyfill namespace have been backdoored to silently install a remote access trojan (RAT) from the DEV#POPPER malware family when a developer imports them into a Node.js project. The malware executes at import time, meaning simply installing and using the package is enough to trigger the infection. This is a supply chain attack targeting developers who may be testing pre-release versions of these UI component libraries.
Security Architect’s Take: Audit your Node.js dependency trees immediately for the two affected package versions and remove them if present. Enforce policies that restrict use of pre-release, beta, or release-candidate npm packages in pipelines, and consider implementing runtime import controls or software composition analysis (SCA) tooling that flags packages with known malicious payloads before they reach developer workstations or CI/CD environments.
Original advisory: Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js