npm Packages Tied to North Korea Pose as Rollup Polyfills to Harvest Developer Secrets
Researchers have connected North Korea-affiliated actors to a new wave of malicious npm packages designed to enable remote access and steal data by disguising themselves as Rollup polyfill utilities.
JFrog reports that two packages — "rollup-packages-polyfill-core" and "rollup-runtime-polyfill-core" — closely copy the legitimate "rollup-plugin-polyfill-node" package, replicating its description, repository details, and overall structure. By adopting naming conventions tied to "rollup," "polyfill," "core," and "node," the fake packages can appear legitimate to developers doing a cursory check of their dependencies, according to JFrog's writeup.
Four additional packages tied to the campaign have since been pulled from the npm registry:
According to the security firm, the follow-on packages function as nearly identical SVG-related tools that pull down a JSON object from JSONKeeper and then execute the code contained in its "model" field. The combination of a multi-stage delivery chain, deceptive naming, convincing-looking package metadata, execution triggered automatically at install time, checks for analysis environments, and payloads built for stealing credentials and enabling remote access all mirror tactics seen in earlier npm campaigns tied to North Korea's Lazarus group.
This isn't the first instance of North Korean-linked actors publishing npm packages that pose as Rollup polyfill utilities. Back in April 2026, Panther documented an extended npm campaign in which 108 malicious packages — spread across 261 versions — were used to distribute BeaverTail and OtterCookie, two malware families associated with the Contagious Interview operation. That campaign included a package called "rollup-plugin-polyfill-route," uploaded on March 20, 2026.
The current attack chain begins with a Base64-obfuscated install command for "swift-parse-stream" (or, alternatively, "quirky-token") buried inside "rollup-packages-polyfill-core" (or "rollup-runtime-polyfill-core"). These second-stage packages present themselves as SVG-sanitizing tools, but their real function is to contact a JSON Keeper endpoint and pull down and run a piece of JavaScript malware.
Before doing anything else, that JavaScript performs environment checks meant to detect and avoid cloud-based dev environments, sandboxes, serverless platforms, and other analysis setups. Once it determines the environment is a genuine target, it installs whatever dependencies it needs and contacts an external server at 216.126.236[.]244 to retrieve an encrypted payload.
Once decrypted, this payload serves as a loader for further malicious scripts. These give the attacker remote access to the infected machine — supporting interactive terminal control, arbitrary command execution, screenshot grabbing, killing processes, and (on Windows systems) simulating mouse movement, clicks, scrolling, keystrokes, and hotkey combinations via the "@nut-tree-fork/nut-js" library. The malware also targets browser and cryptocurrency wallet data, gathers files with specific extensions, and repeatedly grabs the contents of the clipboard.
These capabilities closely resemble those found in OtterCookie. Notably, the use of "@nut-tree-fork/nut-js" to hijack mouse and keyboard input has also turned up before — in a package called "express-session-js," which SafeDep flagged back in April 2026. As for the file-harvesting component, it's been designed to specifically hunt down editor history from Visual Studio Code, Windsurf, and Cursor, plus configuration data tied to developer and AI platforms including AWS, Microsoft Azure, Google Gemini, Anthropic's Claude, Foundry, SSH, and Zsh.
JFrog pointed out that Rollup plugins typically get pulled from sources like local config files, individual developer machines, and CI pipelines — environments that frequently hold sensitive material such as source code, npm tokens, Git credentials, cloud access keys, SSH keys, browser-stored data, and other project secrets.
The firm also noted that the payload goes well beyond a basic downloader. Once its later stages activate, the attacker ends up with both data-collection and full control over the infected machine — a combination that's especially dangerous on developer workstations and build servers, where API keys, SSH credentials, wallet-related data, cloud credentials, and other project secrets tend to reside.
This disclosure arrives alongside several other software supply chain attacks uncovered separately by Checkmarx, SafeDep, and independent AWS security researcher Chi Tran — all aimed at compromising open-source repositories and exfiltrating sensitive data:
Operation Navy Ghost: Checkmarx identified at least eight trojanized forks of the "pyrogram" library, published between November 2025 and June 2026 by an actor using multiple aliases. The packages contain a concealed backdoor giving attackers complete remote control over any infected server — letting them execute arbitrary Python or shell commands and exfiltrate the results through Telegram.
Fake DeFi/arbitrage tooling: SafeDep uncovered a set of 30 npm packages impersonating Polymarket-related tools and generic math libraries, published across 10 separate maintainer accounts. Targeting DeFi developers specifically, the packages deploy a JavaScript-based infostealer that harvests crypto wallet data, saved browser credentials, SSH keys, AWS credentials, npm tokens, Docker configs, shell history, and password manager databases.
The @marketfront campaign: Another SafeDep finding involved 25 npm packages published under the "@marketfront" scope by an account of the same name. These packages run a credential-stealing script during installation that scans for 20 different types of secret/credential files — covering paths like ~/.ssh, ~/.aws/credentials, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.netrc, ~/.pgpass, ~/.git-credentials, ~/.env, and shell history — before sending the data out.
A fake security tool: Chi Tran flagged a Python package called "security-alerts-sdk", marketed as a breach-monitoring utility but secretly running a backdoor. It regularly checks in with a remote server (142.93.211[.]30:5000) for instructions and sends back SSH private keys, AWS credentials, Docker/npm/PyPI/git tokens, .env file contents, and browser-stored credentials.
Operation Friday Harvest: Tran also documented 15 npm packages spread across 13 different npm scopes, all controlled by one threat actor. A postinstall script fetches and runs a Rust-compiled ELF binary hosted on GitHub, which then vacuums up data from crypto wallets, browsers, cloud provider tokens, SSH keys, messaging app sessions, database client configs, and other developer credentials.
A typosquat targeting "events": Tran identified "events-runtime", a package designed to typosquat the popular "events" library. It conditionally activates a crypto wallet stealer, sends host reconnaissance data via Slack and Telegram, sets up a two-way Slack-based command channel, and even pulls configuration and payload fragments from an Ethereum smart contract functioning as a dead drop. Crucially, the malicious behavior only triggers when a specific event ID ("eventId0") is detected.
A split-package evasion technique: Finally, Tran described "o3forms", a package built to steal cloud provider credentials, hunt for developer secrets and CI/CD configuration data, map internal networks, and send everything to a Cloudflare Workers endpoint controlled by the attacker. Tran explained that the attacker deliberately separated the operation into a clean, registry-published package and a GitHub-pinned "*-utils" dependency — with the latter carrying both the install hooks and the actual malicious code. This split design is specifically built to slip past the static analysis and lifecycle-script scanning that most registry and CI security tools rely on.
Anyone who has installed any of the packages mentioned above should remove them immediately, treat their systems as potentially compromised and rotate all affected credentials, block the malicious command-and-control channels, and implement dependency scanning within CI/CD pipelines to catch newly published or otherwise suspicious packages going forward
