Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Node.js developers and CI/CD pipelines
Incident: Two @joyfill npm packages were compromised to deliver a remote access trojan via a blockchain-based command-and-control structure.
Impact: Attackers can achieve arbitrary code execution, steal sensitive data, and establish persistent backdoors on developer systems.
Attacker: PolinRider (associated with Contagious Interview)
Analysis: The attack leverages a sophisticated multi-blockchain resolver across Tron, Aptos, and BNB Smart Chain to fetch encrypted payloads, ensuring high C2 resilience. These implants trigger immediately upon import rather than via lifecycle hooks, increasing the likelihood of execution. The final payload is a DEV#POPPER RAT capable of full system compromise, including file exfiltration and remote shell access.
Recommendations: Audit project dependencies for compromised @joyfill/layouts and @joyfill/components beta versions.; Implement strict dependency pinning and utilize lockfiles to prevent the automatic adoption of malicious beta releases.; Monitor CI/CD pipelines and developer workstations for unusual outbound network traffic to blockchain nodes or unknown IP addresses.
Source: The Hacker News / Socket
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source