Two Joyfill beta packages contained an import-time JavaScript implant that used Tron, Aptos, and BNB Smart Chain transactions to resolve mutable payloads. The recovered chain delivered a DEV#POPPER Node.js RAT capable of remote command execution, file transfer, clipboard collection, and persistence through developer-tool files, while a detached branch contacted a separate boot endpoint and could retrieve a cross-platform credential stealer assessed as an OmniStealer iteration. Exact loader and command-protocol overlap linked the code to the PolinRider and DEV#POPPER families, although Socket did not attribute the Joyfill compromise itself to a particular group. Hosts that imported either affected package should be treated as compromised because package loading, rather than an npm install hook, triggered execution.