Two Malicious NPM Packages Steal Sensitive Data From Developer Machines
Two beta release builds of npm packages in the joyfill namespace were compromised to distribute a remote access trojan linked to the DEV#POPPER malware family. The affected packages contained an import-time JavaScript implant that retrieves encrypted code through transactions on Tron, Aptos, and BNB Smart Chain blockchains. Unlike typical malicious packages that activate through npm lifecycle hooks, this implant executes immediately when Node.js loads the CommonJS package entry point. Security researchers at Socket have connected this attack to the PolinRider threat cluster, which is believed to be associated with the Contagious Interview campaign.
The attack mechanism is sophisticated and uses a multi-layered approach across multiple blockchains. When the package loads, it initiates a blockchain-based lookup that retrieves a BSC transaction hash from a hardcoded Tron address, with a fallback option that queries an Aptos account if the primary method fails. The system then decrypts and executes JavaScript code extracted from these transactions. This blockchain-based command and control infrastructure provides attackers with operational resilience and allows them to modify payloads without publishing new package versions, making detection and prevention more challenging.
The implant follows two parallel execution paths, deploying both an in-process payload and a detached process. The in-process payload acts as a JavaScript loader that fetches a second-stage malware called clientCode through the blockchain resolver. The detached process connects to a specific IP address to download and run additional JavaScript code independently of the importing Node.js process, allowing it to persist even after build or test commands exit. The final clientCode payload functions as a Node.js remote access trojan with extensive capabilities including host information collection, remote control via Socket.IO channels, command execution, file manipulation, and clipboard data theft. Notably, the malware avoids execution on development, CI, or sandbox machines with specific hostnames to evade detection.
Socket researchers confirmed that this attack is part of the same ongoing operation by North Korean threat actors responsible for the earlier ViteVenom campaign, not a separate incident. Both malicious releases were published by the same npm identity using identical Node.js and npm versions, with the malicious code already present at bundle time. The infection vector remains unclear, potentially involving a compromised developer workstation, source repository, CI system, or stolen publishing credentials. A Python infostealer variant believed to be related to OmniStealer malware was also deployed through the detached process, capable of gathering extensive data from infected hosts. Developers who installed affected versions should immediately remove them, pin to trusted versions, and rotate any credentials that may have been exposed.
Stay secure — stay Wavasec. 🔐
