Compromised Joyfill npm packages execute malware via Node.js import

Two beta npm packages from the Joyfill library have been identified as containing malicious code that executes upon import, bypassing traditional install-hook detection. The malware utilizes a multi-blockchain retrieval mechanism to fetch a remote access trojan (RAT) linked to the DEV#POPPER threat actor, maintaining persistence beyond the initial build or test process.