North Korea-linked npm packages impersonate Rollup polyfill tools to steal developer secrets
Security researchers at JFrog have identified a set of malicious npm packages linked to North Korean threat actors that impersonate legitimate Rollup polyfill tooling to steal developer credentials and enable remote access to compromised machines. The packages, named “rollup-packages-polyfill-core” and “rollup-runtime-polyfill-core,” mimic the legitimate “rollup-plugin-polyfill-node” project down to its description, repository metadata, and package structure. […] This story continues at The Next Web
Six malicious npm packages mimicking Rollup polyfill tools stole developer credentials and enabled remote access in a Lazarus-linked campaign.
Security researchers at JFrog have identified a set of malicious npm packages linked to North Korean threat actors that impersonate legitimate Rollup polyfill tooling to steal developer credentials and enable remote access to compromised machines. The packages, named “ rollup-packages-polyfill-core ” and “ rollup-runtime-polyfill-core, ” mimic the legitimate “ rollup-plugin-polyfill-node ” project down to its description, repository metadata, and package structure. All six packages in the campaign have since been removed from the npm registry.
The attack uses a layered delivery chain designed to evade detection. The first-stage packages install hidden second-stage dependencies disguised as SVG utilities, which then fetch a JSON object from a remote hosting service and execute the payload embedded in it. JFrog said the structure, combined with lookalike names, legitimate-looking metadata, and environment checks designed to avoid sandboxes and cloud development platforms, is consistent with previous Lazarus-linked npm campaigns.
Once the later stages execute, the malware gives the attacker both collection and control capabilities across the compromised machine. The payload steals data from web browsers and cryptocurrency wallets, captures clipboard content periodically, and harvests files matching specific extensions. It also targets developer tool configurations for VS Code, Windsurf, and Cursor, along with credentials for AWS, Microsoft Azure, Google Gemini, Anthropic Claude, and SSH keys.
The disclosure arrives alongside a broader wave of supply chain attacks targeting open-source package repositories. Checkmarx, SafeDep, and AWS researcher Chi Tran separately identified clusters of malicious packages across npm and PyPI that steal cloud credentials, cryptocurrency wallets, SSH keys, and developer secrets. Rollup plugins are commonly loaded from developer workstations and CI build pipelines, environments that have proven increasingly vulnerable to supply chain compromises and that often hold access to sensitive assets including source code, API keys, and project secrets .
