Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js
Two @joyfill npm beta packages run an import-time implant that uses Tron, Aptos, and BSC to deliver a DEV#POPPER-linked Node.js RAT.
More info