Two beta release versions of npm packages in the @joyfill namespace (@joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4) were compromised to deliver a Remote Access Trojan (RAT) associated with the DEV#POPPER malware family. The packages contain an import-time JavaScript implant that resolves encrypted code through a multi-blockchain resolver structure using Tron, Aptos, and BNB Smart Chain (BSC) transactions. Unlike other malicious packages triggered via npm lifecycle hooks, this implant runs when Node.js loads the CommonJS package entry point. The implant operates in two parallel branches: (1) an in-process branch that recovers a 77 KB JavaScript payload similar to DEV#POPPER malware family, and (2) a secondary detached Node.js process that requests a separate boot payload from IP 23.27.13[.]43, decrypts the response, and evaluates it. The blockchain-based C2 infrastructure provides operational resilience and allows payload switching without publishing new package versions. The attack chain uses blockchain resolution to retrieve a second-stage malware named 'clientCode.' The final RAT payload is heavily obfuscated and avoids execution on development/CI/sandboxed machines with hostnames: github-runner, buildbot, buildkitsandbox, and microsoft-standard-WSL2. RAT capabilities include: file upload, retrieving additional JavaScript, collecting host details, sending status check-ins, and reading clipboard data via PowerShell (Windows), pbpaste (macOS), or xclip/xsel (Linux). A Python infostealer assessed to be an iteration of OmniStealer malware is also delivered via the detached process, capable of harvesting: environment and host info, Windows Credential Manager and Linux Secret Service data, Chromium and Firefox browser data, browser extension storage for wallets and password managers, Git credentials, GitHub CLI configuration, GitHub Desktop logs, and Microsoft Visual Studio Code storage. Both malicious versions were published by the same npm identity using Node.js 18.20.0 and npm 10.5.0. This campaign is connected to ViteVenom and attributed to North Korean threat actors as part of a single ongoing operation linked to the PolinRider threat cluster and Contagious Interview.