North Korea's Lazarus Group Hid a Full RAT in Six Rollup Polyfill npm Packages

North Korean state-linked hackers buried a full remote-access toolkit inside six fake npm packages disguised as widely-used Rollup build tooling, JFrog Security Research disclosed June 30 — and the attack fires at the moment a developer imports the package, not at install time, meaning npm's most significant new security default does not stop it.

The campaign, detailed by JFrog researcher Yair Benamou, centered on six packages that copied the README text, repository metadata, and package shape of the legitimate rollup-plugin-polyfill-node project, which draws roughly 295,000 weekly downloads. The two primary entry packages — rollup-packages-polyfill-core and rollup-runtime-polyfill-core — placed themselves in the same naming space as that widely-used tool, presenting a plausible dependency to any developer who did not inspect them closely. According to JFrog Security Research , the packages replicated the legitimate project's description, repository metadata, and package structure with high fidelity.

All six packages have since been removed from the npm registry.

What made this campaign harder to catch than a standard naming trick was the care taken to replicate legitimacy. JFrog's analysis confirmed that the fake packages reproduced the real project's README almost verbatim, pointed both repository and homepage metadata back to the genuine GitHub project, and included functional Rollup polyfill code in their entry points — with the malicious logic appended beneath it.

The attack also made a deliberate architectural choice: only the CommonJS dist/index.js entry point was backdoored. The ESM variant was left completely clean. Many automated linting and security-scanning tools run against a package's primary import path; keeping the ESM version clean was a studied attempt to stay below that threshold.

"Lookalike build dependencies deserve careful review even when the name is not an obvious typo," JFrog wrote in its analysis. "A copied README, a trusted repository link, and functional-looking package code can be enough to hide a serious compromise."

This technique is distinct from both standard typosquatting (which relies on mistyped names) and dependency confusion (which exploits private-registry namespace collisions). The Rollup polyfill campaign used deliberate brand impersonation — creating plausible-looking new packages that occupy the same conceptual naming territory without obvious misspellings, a technique that defeats name-similarity detection tools entirely.

The infection chain relied on layered indirection. The two primary packages did not carry the final malicious payload directly. Instead, at import time, each silently executed a Base64-encoded npm install command — encoded as a string constant to evade simple string-matching — to pull down a second-stage package: swift-parse-stream and quirky-token, respectively. A third pathway ran through react-icon-svgs, which fetched rollup-plugin-polyfill-connect as its second stage.

The second-stage packages presented themselves as SVG sanitization utilities. At the end of each, a function fetched a JSON object from a URL on jsonkeeper.com and passed the model field directly to JavaScript's eval(). Because the actual malicious code lived at that remote URL rather than inside the published packages, it was absent from the package files themselves and invisible to static registry analysis.

That remote payload first performed an environment sweep, checking for more than 15 variables indicating cloud development environments, sandboxes, serverless runtimes, or analysis infrastructure — including CODESPACE_NAME, VERCEL, AWS_REGION, GOOGLE_CLOUD_PROJECT, AZURE_FUNCTIONS_ENVIRONMENT, and DOCKER. Machines that passed this filtering step then fetched a final AES-256-CBC-encrypted payload from a hardcoded IP address (216.126.236.244), which JFrog confirmed was still serving the payload at the time of their June 30 analysis. The decrypted payload weighed approximately 114 kilobytes.

npm v12, which is shipping in July 2026, blocks postinstall and other lifecycle scripts from executing by default — a major change directly targeting the mechanism behind earlier supply chain attacks such as the Shai-Hulud worm and the Mastra AI compromise. npm v12's security changes represent the most significant security redesign the package manager has seen in years.

The Rollup polyfill attack is not stopped by that change.

The malicious code does not run during npm install. It runs when a developer or CI job require()s the package as part of a build or configuration file. That is import-time execution, not install-time execution — a different attack surface that npm v12's script-blocking defaults do not address. A developer who updated to npm v12 specifically because of TechTimes's June 13 coverage of its security improvements would be no safer against this class of attack.

JFrog's technical analysis identified four parallel components operating after the final stage decrypted and launched.

The remote-access module — scdata.js — used Socket.IO to establish a persistent connection to the attacker's command-and-control server on port 4801. It supported interactive terminal sessions via node-pty, SSH connections, arbitrary command execution, screenshot capture on Windows, and full mouse movement, keyboard input, and clipboard control via @nut-tree-fork/nut-js. The module also performed VM detection using platform-native queries to identify analysis environments, looking for strings such as vmware, virtualbox, and qemu.

A browser and wallet harvester — ldata.js — targeted saved credential files across Chrome, Edge, Brave, Opera, and other Chromium-based browsers on Windows, macOS, and Linux, along with local extension storage for dozens of browser extensions. The recovered extension ID list included MetaMask and other well-known cryptocurrency wallets. On macOS, the payload additionally targeted the user's login.keychain-db.

A broad file collector recursively scanned user directories for files matching patterns from .env and .pem to .json, .pdf, and .xlsx, with specific targeting of editor history folders for Visual Studio Code, Windsurf, and Cursor. Developer and AI tool configuration directories were also in scope, including .aws, .azure, .ssh, .foundry, .gemini, .claude, and shell history files — a targeting profile that maps precisely to the credential surface of a software developer running modern AI-assisted tooling.

Finally, a clipboard monitor used platform-native utilities to capture copied content, designed to intercept tokens, wallet addresses, seed phrases, and other secrets as they passed through the clipboard.

JFrog attributed the campaign to North Korean Lazarus-linked threat actors based on overlapping tactics, techniques, and procedures with prior campaigns. The use of @nut-tree-fork/nut-js for remote mouse and keyboard control was independently observed in express-session-js, a package SafeDep attributed to DPRK actors in April 2026.

This was also not the first time this specific ecosystem niche was targeted. In April 2026, Panther documented a sustained DPRK npm campaign involving 108 malicious packages across 261 versions, delivering the known malware families BeaverTail and OtterCookie — including a package named rollup-plugin-polyfill-route published on March 20, 2026. The current campaign's payload architecture overlaps significantly with OtterCookie, suggesting continued refinement of the same underlying toolchain.

Lazarus Group is designated by the U.S. Treasury's Office of Foreign Assets Control as an agency and instrumentality of the North Korean government, operating under the Reconnaissance General Bureau. The group has a documented pattern of targeting developer environments, cryptocurrency infrastructure, and financial institutions to generate revenue for the North Korean regime — revenue that U.S. government agencies have linked to the country's weapons programs.

The JFrog disclosure arrived alongside a cluster of separately discovered npm and PyPI supply chain campaigns disclosed by Checkmarx, SafeDep, and AWS security researcher Chi Tran during the same period. These included trojanized forks of the pyrogram Telegram library deploying backdoors that exfiltrate data via Telegram — dubbed Operation Navy Ghost by Checkmarx — packages mimicking Polymarket tooling targeting decentralized-finance developers, and a package named events-runtime that used an Ethereum smart contract as a dead-drop resolver to receive commands.

The parallel disclosures on the same week reflect how software supply chain attacks have matured from isolated incidents into a sustained, multi-actor threat running at industrial scale. According to Socket's ongoing Contagious Interview tracking , North Korean state actors have published hundreds of malicious npm packages with tens of thousands of collective downloads since late 2024.

JFrog recommends that anyone who installed any of the six malicious packages treat the affected machine as fully compromised before taking remediation steps. The specific guidance from the research team:

Remove rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, react-icon-svgs, and rollup-plugin-polyfill-connect from all affected projects and lockfiles. Inspect dependency trees for transitive pulls of the second-stage packages.

development machines and CI runners for temporary files named pack, scdata, or ldata, and for processes or command lines connecting to 216.126.236.244. Block outbound communication to that IP and to jsonkeeper.com/b/3P9BF.

Rotate all potentially exposed credentials: npm tokens, GitHub credentials, cloud provider keys for AWS, Azure, and GCP, SSH keys, wallet seed phrases, and any secrets stored in browser profiles.

Enable dependency scanning in CI/CD pipelines configured to flag newly published or unexpected packages. Because this campaign used import-time execution rather than install-time lifecycle scripts, disabling install scripts alone — including under npm v12's new defaults — is not sufficient protection against this specific attack class.

All six packages are detected by JFrog Xray and JFrog Curation .

Check your package.json, package-lock.json, and node_modules directory for any of the six package names: rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, react-icon-svgs, or rollup-plugin-polyfill-connect. Also inspect CI/CD pipeline logs for any npm install commands that pulled any of these names, including as transitive dependencies. If any are present, JFrog advises treating the entire machine as compromised and rotating all credentials before doing anything else.

The payload targeted a broad range of developer and AI-tool credentials: npm and GitHub tokens, cloud provider API keys for AWS, Azure, and Google Cloud, SSH private keys, cryptocurrency wallet seed phrases and extension storage (including MetaMask), browser-saved passwords and web session data, .env files and any file containing the word secret or private key, and the macOS login keychain database. The file collector also specifically targeted configuration directories for Anthropic Claude, Google Gemini, AWS, Azure, and Foundry — a targeting profile designed for developers running AI-assisted tooling.

No — not against this specific attack class. npm v12's most significant security change is blocking postinstall and other lifecycle scripts from executing by default. This would have stopped attacks like the Shai-Hulud worm and the Mastra AI compromise, which used install-time hooks. The Rollup polyfill malware fires when the package is require()d at import time during a build or configuration load — a different execution path that npm v12's script-blocking defaults do not address. Defensive measures that do help include dependency scanning tools that detect behavioral anomalies (such as Socket or JFrog Curation), pinned lockfiles, and auditing any newly introduced dependency before running builds.

Standard typosquatting relies on developers mistyping a package name — for example, recat instead of react. The Rollup polyfill campaign used a different technique: deliberate brand impersonation. The fake packages copied the real project's README almost verbatim, pointed both the repository and homepage metadata fields back to the genuine GitHub repository, and included functional Rollup polyfill code alongside the malicious payload. There are no significant spelling variations in the package names — they occupy the same conceptual naming space as the real tool. This defeats name-similarity detection tools and passes the kind of casual dependency review that catches obvious typos.