Threat Brief — 2026-07-29 — npm supply chain strikes again

Executive summary

Two beta-release npm packages in the @joyfill namespace were compromised to deliver a RAT linked to the DEV#POPPER malware family, triggered on import into Node.js projects. This is the latest in a relentless wave of supply-chain attacks targeting JavaScript package ecosystems. No new developments on previously reported stories warrant inclusion today.

Top items

• Compromised @joyfill npm packages deliver RAT on import. Beta versions of two packages in the @joyfill namespace were tampered with to execute a remote access trojan associated with the DEV#POPPER malware family when imported into a Node.js application. Any project pulling recent @joyfill beta releases should audit lockfiles, pin to known-good versions, and check for post-install script execution or unexpected network callbacks. (src: The Hacker News)

Themes

Supply-chain persistence. The npm compromise reinforces the pattern we've seen throughout July — attackers continue to target package registries and CI/CD adjacent tooling as high-leverage entry points. The GitHub Dependabot cooldown reported earlier this week (first reported 2026-07-26 via BleepingComputer) is a direct response to this class of attack, but teams still need to treat beta and pre-release package versions as inherently higher risk.