North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets

1. Executive summary

JFrog has identified a campaign distributing malicious npm packages that impersonate the legitimate rollup-plugin-polyfill-node project to deliver remote-access and data-theft payloads targeting developer workstations and CI environments. The packages use a layered installation chain: first-stage lookalike packages (rollup-packages-polyfill-core, rollup-runtime-polyfill-core, react-icon-svgs) install second-stage packages (swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect) that fetch and execute JavaScript malware from an external server at 216.126.236[.]244. Attribution to North Korea's Lazarus Group (MITRE G0032) is based on JFrog's assessment of overlap with previous Lazarus-linked npm campaigns; this is a single-vendor attribution and should be treated as unconfirmed pending independent corroboration. EMEA financial services with JavaScript/Node.js build pipelines consuming npm dependencies are at risk of source-code, cloud-credential, SSH-key, and browser-data exfiltration, as well as interactive remote access to developer and CI hosts.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Initial access vector — typosquat/lookalike npm packages. A developer or CI pipeline installs one of three first-stage packages that closely mimic the legitimate rollup-plugin-polyfill-node project: - rollup-packages-polyfill-core - rollup-runtime-polyfill-core - react-icon-svgs

These packages replicate the legitimate project's description, repository metadata, and package shape, placing themselves in the same rollup, polyfill, core, and node naming space.

2. Second-stage installation via hidden install-time execution. The first-stage packages install and load second-stage packages: - rollup-packages-polyfill-core → installs swift-parse-stream - rollup-runtime-polyfill-core → installs quirky-token - react-icon-svgs → installs rollup-plugin-polyfill-connect

The install command for the second-stage package is Base64-encoded and concealed within the first-stage package, executing at install time.

3. Remote payload retrieval. The second-stage packages are dressed as SVG sanitization utilities. They fetch a JSON object from a JSONKeeper URL and eval the model field, executing JavaScript malware.
4. Environment checks. The JavaScript code runs checks to avoid execution within: - Cloud development environments - Sandboxes - Serverless runtimes - Analysis infrastructure
5. Encrypted payload fetch. Past the environment-gate, the malware installs necessary dependencies and contacts an external server at 216.126.236[.]244 to fetch an encrypted JavaScript payload.
6. Payload execution — loader. The decrypted payload acts as a loader for additional scripts enabling: - Remote access: Interactive terminal sessions, command execution - Screen capture: Screenshot capture - Process management: Process termination - Input simulation (Windows-only): Mouse movement, clicks, scrolling, keyboard presses, and hotkeys via the @nut-tree-fork/nut-js package - Data theft: Browser data, cryptocurrency wallet data, files matching specific extensions, periodic clipboard capture
7. File collection targets. The file collector specifically targets: - Editor history: Microsoft Visual Studio Code, Windsurf, Cursor - Developer/AI tool configurations: AWS, Microsoft Azure, Google Gemini, Anthropic Claude, Foundry, SSH, Z shell (Zsh)

Additional context

• All six malicious packages (rollup-packages-polyfill-core, rollup-runtime-polyfill-core, react-icon-svgs, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect) have been removed from the npm registry.
• The campaign shares TTPs with a previous campaign detailed by Panther in April 2026, which published 108 malicious npm packages across 261 versions delivering BeaverTail and OtterCookie malware linked to the Contagious Interview operation. That campaign included the package rollup-plugin-polyfill-route (published March 20, 2026).
• The use of @nut-tree-fork/nut-js for remote mouse/keyboard control was also observed in a package named express-session-js, detailed by SafeDep in April 2026.
• A related but separate incident (SecurityWeek, single-sourced) reports a malicious dependency added to over 140 Mastra packages that fetches a payload targeting cryptocurrency extensions. This is attributed to North Korean hackers but is a distinct campaign; verify before conflating with this item.

Attribution caveat

Attribution to Lazarus Group (MITRE G0032) is based on JFrog's assessment of TTP overlap with previous North Korean npm campaigns. This is a single-vendor attribution; no independent government or multi-vendor corroboration is present in the source material. Treat as unconfirmed.

4. Mitigation & containment

P1 — Within 24 hours

1. Audit npm dependencies. Search all package.json, package-lock.json, yarn.lock, and pnpm-lock.yaml files across repositories and CI configurations for the six malicious package names: rollup-packages-polyfill-core rollup-runtime-polyfill-core react-icon-svgs swift-parse-stream quirky-token rollup-plugin-polyfill-connect Also check npm ls output on all developer workstations and CI runners.
2. Block the known C2 IP. Add 216.126.236.244 to firewall deny-lists, egress proxy blocklists, and EDR network containment rules. Apply at all developer workstation and CI/CD build-host network segments.
3. Isolate compromised hosts. Any workstation or CI runner found to have installed any of the six packages should be isolated from the network, presumed compromised, and forensically imaged. Do not simply uninstall the package — the payload has already executed.
4. Revoke credentials. On any compromised host, immediately rotate: - npm tokens (.npmrc) - Git credentials (SSH keys, GitHub/GitLab tokens) - Cloud keys: AWS access keys, Azure credentials, Google Cloud/Gemini API keys, Anthropic Claude API keys, Foundry credentials - SSH keys - Browser-stored credentials and session tokens

P2 — Within 72 hours

5. Hunt for post-exploitation artefacts. Search for: - The @nut-tree-fork/nut-js package in node_modules directories (indicates payload execution) - Files matching collected extensions on developer workstations - Clipboard-monitoring processes - Screenshot-capture activity - Unexpected outbound connections to JSONKeeper URLs or 216.126.236.244
6. Review CI/CD pipeline logs. Check build logs for install-time execution of Base64-encoded commands, especially during npm install steps. Look for environment-variable access and outbound network calls during dependency installation.
7. Implement npm registry proxying. Route all npm installs through an internal registry proxy (e.g., Artifactory, Nexus, Verdaccio) with allow-listing or at minimum package-name vetting. Block direct installs from the public npm registry on CI runners.

P3 — Within 7 days

8. Implement dependency integrity verification. Use npm audit signatures, SLSA provenance checks, or tools like socket or snyk to verify package integrity. Pin all dependencies to exact versions with integrity hashes in lockfiles.
9. Restrict install-time scripts. Use npm install --ignore-scripts by default in CI pipelines. Only allow postinstall scripts for vetted, trusted packages. Configure .npmrc with ignore-scripts=true as a baseline.
10. Developer awareness. Brief all developers on typosquatting in the rollup/polyfill namespace. The legitimate package is rollup-plugin-polyfill-node — any variation in naming is suspect.

5. Indicators of compromise

ipv4  216.126.236.244
npm-package  rollup-packages-polyfill-core
npm-package  rollup-runtime-polyfill-core
npm-package  react-icon-svgs
npm-package  swift-parse-stream
npm-package  quirky-token
npm-package  rollup-plugin-polyfill-connect
npm-package  rollup-plugin-polyfill-route
npm-package  express-session-js
npm-package  @nut-tree-fork/nut-js

6. Detection

YARA rule

rule NPM_Rollup_Polyfill_Lookalike_Campaign {
    meta {
        author = "Adverse Trace"
        date = "2026-07-03"
        reference = "https://thehackernews.com/2026/07/north-korea-linked-npm-packages-mimic.html"
        description = "Detects malicious npm packages mimicking rollup-plugin-polyfill-node with remote-access and data-theft payloads"
    }
    strings:
        $pkg1 = "rollup-packages-polyfill-core" nocase
        $pkg2 = "rollup-runtime-polyfill-core" nocase
        $pkg3 = "swift-parse-stream" nocase
        $pkg4 = "quirky-token" nocase
        $pkg5 = "rollup-plugin-polyfill-connect" nocase
        $pkg6 = "react-icon-svgs" nocase
        $nutjs = "@nut-tree-fork/nut-js" nocase
        $c2 = "216.126.236.244"
        $jsonkeeper = "jsonkeeper" nocase
        $beavertail = "BeaverTail" nocase
        $ottercookie = "OtterCookie" nocase
    condition:
        2 of ($pkg*) or ($nutjs and $c2) or ($jsonkeeper and any of ($pkg*))
}

Sigma rule

title: NPM Malicious Package C2 Connection - Rollup Polyfill Lookalike Campaign
id: 6f3a-2b1c-4d5e-8f9a-at20260703
status: experimental
description: Detects network connections to C2 server associated with North Korea-linked npm packages mimicking rollup polyfill tooling
references:

  - https://thehackernews.com/2026/07/north-korea-linked-npm-packages-mimic.html
author: Adverse Trace
date: 2026/07/03
logsource:
    product: windows
    category: network_connection
detection:
    selection_ip:
        DestinationIp|contains:

            - "216.126.236.244"
    selection_process:
        Image|contains:

            - "\\node.exe"
            - "\\npm.exe"
            - "\\npx.exe"
    condition: selection_ip and selection_process
falsepositives:

    - Unlikely — this IP is not associated with legitimate services
level: high

title: NPM Malicious Package Install - Rollup Polyfill Lookalike Names
id: 7a4b-3c2d-5e6f-9a0b-at20260703
status: experimental
description: Detects installation of known malicious npm packages from the Rollup polyfill lookalike campaign
references:

  - https://thehackernews.com/2026/07/north-korea-linked-npm-packages-mimic.html
author: Adverse Trace
date: 2026/07/03
logsource:
    product: linux
    product: windows
    category: process_creation
detection:
    selection_cmd:
        CommandLine|contains:

            - "rollup-packages-polyfill-core"
            - "rollup-runtime-polyfill-core"
            - "swift-parse-stream"
            - "quirky-token"
            - "rollup-plugin-polyfill-connect"
            - "react-icon-svgs"
    condition: selection_cmd
falsepositives:

    - Legitimate use of similarly named packages (unlikely given exact match)
level: high

Threat actor context

Lazarus Group · G0032 · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. …

7. Sources

• The Hacker News — "North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets" — https://thehackernews.com/2026/07/north-korea-linked-npm-packages-mimic.html — 2026-07-03
• SecurityWeek — "North Korean Hackers Blamed for Mastra NPM Supply Chain Attack" — https://www.securityweek.com/north-korean-hackers-blamed-for-mastra-npm-supply-chain-attack/ — 2026-07 (related but distinct campaign; single-sourced)

8. Adverse Trace position

This is a credible, well-documented supply-chain attack campaign with clear technical detail from JFrog. The attack chain is multi-layered and specifically targets developer environments — the exact systems holding source code, cloud credentials, SSH keys, and npm tokens that EMEA financial institutions rely on for their build pipelines. The C2 IP 216.126.236.244 and all six package names are actionable IOCs for immediate blocking and dependency auditing. Attribution to Lazarus Group (MITRE G0032) is single-sourced from JFrog based on TTP overlap; we assess this as plausible but unconfirmed — we will not propagate it as fact until independent corroboration emerges. The packages have been removed from npm, reducing the risk of new installations, but any environment that installed them before removal should be treated as potentially compromised. We are monitoring for additional packages in the rollup/polyfill namespace and for any reappearance of the C2 infrastructure. Clients with Node.js/JavaScript build pipelines should immediately audit dependencies, block the C2 IP, and review CI/CD install-time script execution policies.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.