North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets

Summary: JFrog linked a set of malicious npm packages, including "rollup-packages-polyfill-core" and "rollup-runtime-polyfill-core," to North Korea-tied actors; the packages mimic the legitimate "rollup-plugin-polyfill-node" project down to its description, repository metadata, and package shape, and four other related packages have since been removed from the npm registry. The lookalikes install second-stage packages disguised as SVG utilities that fetch a JSON object from JSONKeeper and eval the model field, then check for cloud development environments, sandboxes, serverless runtimes, and analysis infrastructure before contacting 216.126.236[.]244 for an encrypted payload that enables remote terminal sessions, command execution, screenshot and clipboard capture, and theft of browser and cryptocurrency wallet data.
Bottom line: The file collector specifically targets editor history for VS Code, Windsurf, and Cursor plus AWS, Azure, Gemini, Claude, Foundry, SSH, and Zsh configurations - the credentials sitting on the developer workstations and CI jobs where Rollup plugins are routinely loaded.

Read the original at The Hacker News ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026