Critical

Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

The Hacker News

July 29, 2026 at 4:20 AM

Actively Exploited

Overview

Two beta versions of npm packages from the @joyfill namespace have been compromised to include a remote access trojan (RAT) linked to the DEV#POPPER malware family. The affected packages are @joyfill/layouts version 0.1.2-2773.beta.0 and @joyfill/components version 4.0.0-rc24-2773-beta.4. When these packages are imported into a Node.js environment, they execute an implant that runs encrypted malicious code. This incident poses a significant risk to developers who might unknowingly use these compromised packages in their projects. Users are advised to avoid these specific versions and monitor for any unusual activity in their systems.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: @joyfill/layouts@0.1.2-2773.beta.0, @joyfill/components@4.0.0-rc24-2773-beta.4
Action Required: Avoid using the affected package versions and monitor systems for unusual activity.
Timeline: Newly disclosed

Original Article Summary

Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan (RAT) associated with the DEV#POPPER malware family. The list of affected packages is as follows - @joyfill/layouts@0.1.2-2773.beta.0 @joyfill/components@4.0.0-rc24-2773-beta.4 The two packages "contain an import-time JavaScript implant that resolves encrypted code

Impact

@joyfill/layouts@0.1.2-2773.beta.0, @joyfill/components@4.0.0-rc24-2773-beta.4

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Avoid using the affected package versions and monitor systems for unusual activity.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware, Trojan.

Read Original Article

Related Coverage

AI Speeds Up Malware Development, Not Its Success Rate: Analysis

SecurityWeek

A recent analysis by Palo Alto Networks' Unit 42 examined 405 malware samples that are linked to artificial intelligence. The findings revealed that while AI can accelerate the development of malware, it does not necessarily improve its success rate. Out of the analyzed samples, only 12 managed to reach production endpoints, which indicates that most AI-generated malware struggles to effectively infiltrate systems. This study is significant as it suggests that while cybercriminals may adopt AI to create malware more quickly, the effectiveness of these tools remains limited. Companies and security teams should continue to focus on traditional defenses as the majority of AI-linked malware is not successfully deployed.

Aug 26, 2026

Boston Scientific says cyberattack disrupted operations globally

BleepingComputer

Boston Scientific, a medical technology company, recently suffered a cyberattack that disrupted its IT systems, leading to operational issues across its global operations. The attack affected various aspects of the company's services, although specific details about the systems or products impacted were not disclosed. This incident raises concerns about the security of healthcare technology, as disruptions in medical services can have serious implications for patient care. Companies in the healthcare sector need to remain vigilant against such cyber threats, ensuring their systems are secure to protect sensitive patient data and maintain operational integrity.

Aug 26, 2026

FBI disrupts proxy network enabling Chinese espionage operations

BleepingComputer

The FBI has taken action against a proxy network that was facilitating Chinese espionage operations. This network acted as a technical 'quartermaster', providing tools for reconnaissance and management of proxy servers used in cyber spying activities. The disruption aims to dismantle the infrastructure that allowed these operations to flourish, targeting the methods that adversaries used to conceal their actions. This incident is significant as it reflects ongoing efforts to counteract foreign cyber threats and protect sensitive information. It emphasizes the importance of vigilance against cyber espionage tactics that can undermine national security and compromise data integrity.

Aug 26, 2026

Snowflake ends service-account passwords. Now comes the hard part

BleepingComputer

Snowflake has decided to discontinue password authentication for its legacy service accounts, which means organizations will need to switch to passwordless authentication methods. This change aims to enhance security by reducing reliance on passwords, but it poses significant challenges for companies. They must identify what each service account is used for, who manages them, and the level of access each account requires. This process is crucial to ensure that the migration to passwordless systems does not disrupt operations or leave any security gaps. As organizations navigate this transition, they will need to carefully assess their service account configurations and access controls.

Aug 26, 2026

Election official says Tina Peters would be consultant, won’t have access to election systems

CyberScoop

Shasta County's registrar, Clint Curtis, has announced plans to enlist Tina Peters as a consultant for the county's 2026 elections. Despite Peters' past conviction related to election security breaches in Colorado, Curtis expressed confidence in her ability to assist with managing the election process. He emphasized that Peters would not have access to any election systems, aiming to alleviate concerns about potential security risks. This decision has sparked debate, particularly given Peters' controversial history in the election integrity realm. The implications of bringing someone with her background into a role, even without system access, could affect public trust in the electoral process.

Aug 26, 2026

CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing

The Hacker News

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently completed red team assessments on two critical infrastructure organizations, both of which were compromised at the domain level. Despite using similar tactics, only one organization detected the intrusion. This stark difference in defensive outcomes raises concerns about the readiness of critical infrastructure sectors to withstand cyberattacks. The findings emphasize the need for improved security measures and threat detection capabilities within these organizations to better protect against potential breaches that could disrupt essential services. CISA's assessment serves as a crucial reminder of the vulnerabilities that exist within critical infrastructure and the ongoing need for vigilance in cybersecurity practices.

Aug 26, 2026