North Korean Malicious npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
Executive Summary
In July 2026, cybersecurity researchers identified a campaign by North Korean threat actors involving malicious npm packages disguised as Rollup polyfill tools. These packages, including 'rollup-packages-polyfill-core' and 'rollup-runtime-polyfill-core,' closely mimicked legitimate projects to deceive developers. Upon installation, they executed hidden scripts that established remote access and exfiltrated sensitive data such as credentials for AWS, Azure, and cryptocurrency wallets. The attack leveraged a multi-stage delivery mechanism, with initial packages installing secondary payloads that fetched and executed malicious code from external servers. This approach enabled the attackers to evade detection and maintain persistence on compromised systems. (thehackernews.com)
This incident underscores a growing trend of sophisticated supply chain attacks targeting open-source ecosystems. By compromising widely used development tools, attackers can infiltrate numerous organizations, highlighting the critical need for enhanced vigilance and security measures in software development practices.
Why This Matters Now
The increasing prevalence of supply chain attacks targeting open-source repositories poses significant risks to software development and organizational security. Developers and organizations must implement stringent dependency management and monitoring practices to mitigate these evolving threats.
Attack Path Analysis
Threat actors with ties to North Korea uploaded malicious npm packages mimicking legitimate Rollup polyfill tools. Upon installation, these packages executed hidden commands to install second-stage payloads, which then fetched and executed JavaScript malware from external servers. The malware established remote access, enabling command execution and data theft from compromised developer systems.
Kill Chain Progression
Initial Compromise
Description
Developers unknowingly installed malicious npm packages ('rollup-packages-polyfill-core' and 'rollup-runtime-polyfill-core') that mimicked legitimate Rollup polyfill tools.
Related CVEs
MAL-2026-6372
CVSS 10The npm package 'rollup-runtime-polyfill-core' contains malicious code that installs and executes arbitrary code from the attacker-controlled 'quirky-token' package, leading to potential full system compromise.
Affected Products:
N/A rollup-runtime-polyfill-core – 0.13.7
Exploit Status:
exploited in the wildMAL-2026-6520
CVSS 10The npm package 'rollup-plugin-polyfill-connect' contains malicious code that compromises any computer on which it is installed or running, potentially leading to full system compromise and unauthorized access to secrets and keys.
Affected Products:
N/A rollup-plugin-polyfill-connect – all versions
Exploit Status:
exploited in the wildMAL-2026-976
CVSS 10The npm package 'rollup-plugin-polyfill-swc' contains malicious code that can fully compromise a host system, necessitating immediate rotation of all secrets and keys from a separate, secure machine.
Affected Products:
N/A rollup-plugin-polyfill-swc – all versions
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Compromise Software Supply Chain
User Execution: Malicious Library
Credentials from Password Stores
Application Layer Protocol
Obfuscated Files or Information
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Supply Chain Risk Management
Control ID: 3.1
NIS2 Directive – Security of Supply Chains
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Critical exposure to North Korean supply chain attacks targeting npm packages, compromising developer secrets and enabling remote access through malicious polyfill dependencies.
Information Technology/IT
High risk from sophisticated npm package mimicry attacks affecting development toolchains, requiring enhanced egress security and zero trust segmentation controls.
Financial Services
Severe threat from developer-targeted supply chain compromises potentially exposing sensitive financial systems through infected development environments and stolen credentials.
Computer/Network Security
Direct impact from advanced persistent threats using legitimate-appearing npm packages to infiltrate security vendor environments and steal proprietary threat intelligence.
Sources
- North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secretshttps://thehackernews.com/2026/07/north-korea-linked-npm-packages-mimic.htmlVerified
- Lazarus-Linked npm Malware Masquerades as Rollup Polyfills - JFrog Security Researchhttps://research.jfrog.com/post/rollup-polyfill-masquerading/Verified
- MAL-2026-6520: Malicious code in rollup-plugin-polyfill-connect (npm) - Live Threat Intelligence - Threat Radar | OffSeq.comhttps://radar.offseq.com/threat/mal-2026-6520-malicious-code-in-rollup-plugin-poly-555778270623d7fbVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to execute hidden commands and install second-stage payloads would likely be constrained, reducing the scope of the initial compromise.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges and execute additional malicious code would likely be limited, reducing the potential impact of the attack.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally within the network would likely be constrained, limiting the spread of the malware.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish command and control channels would likely be limited, reducing the effectiveness of remote access.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data would likely be constrained, reducing the risk of data loss.
The attacker's ability to access and exploit sensitive developer information would likely be limited, reducing the potential for financial loss.
Impact at a Glance
Affected Business Functions
- Software Development
- Continuous Integration/Continuous Deployment (CI/CD) Pipelines
Estimated downtime: 7 days
Estimated loss: $50,000
Potential exposure of developer credentials, including access tokens for cloud services and cryptocurrency wallets.
Recommended Actions
Key Takeaways & Next Steps
- • Implement strict dependency management policies to verify the authenticity of open-source packages before installation.
- • Utilize threat detection and anomaly response systems to identify and respond to unusual behaviors associated with package installations.
- • Enforce zero trust segmentation to limit the potential spread of malicious code within development environments.
- • Apply egress security and policy enforcement to monitor and control outbound connections from development systems.
- • Conduct regular security audits and educate developers on the risks associated with third-party packages and supply chain attacks.
