DEV#POPPER

Named by 5 kept items in this workspace.

3 items name it under threat actors and 2 under classification.key entities.

Search every workspace for DEV#POPPER. It matches the name as written, so it can find other things that share it.

The items that name it 5

Socket: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
writeupas threat actors2026-09-20
Remote Access Trojan malware family delivered via the compromised Joyfill npm beta releases; recovered 77 KB clientCode payload matches DEV#POPPER on Sec-V and /$/boot, the ThZG+0jfXE6VAGOJ decryptor key, Socket.IO use, the ss_* command set, and persistence through developer-tool files.
PolinRider Caused Dozens of npm, Go, PHP Compromises
writeupas classification.key entities2026-07-31
PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
writeupas classification.key entities2026-07-08
Socket: PolinRider
writeupas threat actors2026-07-02
Malware payload observed being delivered by PolinRider loaders
Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package
writeupas threat actors2026-06-01
DPRK-linked RAT delivered via the same blockchain-C2 infrastructure in prior reports

All threat actors in this workspace.