Affected Systems

npm ecosystem: malicious packages "rollup-packages-polyfill-core" and "rollup-runtime-polyfill-core" impersonating legitimate "rollup-plugin-polyfill-node". Affects developers using npm/Node.js build toolchains, particularly those working with rollup bundler configurations.

Exploitation Status

Active supply chain attack. Malicious packages published to npm registry and discovered by JFrog. Packages designed to steal secrets and establish remote access upon installation. Threat actor: North Korea-linked APT.

Business Impact

Developers who installed these packages have exposed environment variables, credentials, API keys, and source code. Attackers gain persistent remote access to developer workstations and CI/CD pipelines. Compromised secrets may enable lateral movement into production environments, source code repositories, and cloud infrastructure. No CVE assigned as this is a malicious package campaign, not a software vulnerability.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately search all developer workstations and CI/CD systems for packages 'rollup-packages-polyfill-core' and 'rollup-runtime-polyfill-core' using 'npm list' or package-lock.json audits
  • Rotate all credentials, API keys, and secrets accessible from any environment where these packages were installed, including cloud provider keys, GitHub tokens, and database passwords
  • Review npm audit logs and package installation history for typosquatting variants of 'rollup-plugin-polyfill-node' installed in the past 90 days
  • Implement npm package verification controls: enable package provenance checking, use lock files with integrity hashes, and restrict installations to verified publishers where possible
  • Monitor network traffic from developer systems for unexpected outbound connections, particularly to North Korean infrastructure or known APT command-and-control domains

---

# Threat Actor Context

Actor Profile

Lazarus is a North Korea-linked advanced persistent threat (APT) group attributed to the Reconnaissance General Bureau (RGB), North Korea's primary foreign intelligence service. The group is financially motivated, conducting operations to generate revenue for the regime through cryptocurrency theft, supply chain attacks, and targeting of financial institutions. Lazarus has demonstrated sophisticated capabilities in social engineering, supply chain compromise, and custom malware development. The group's operations support North Korea's strategic objectives, including sanctions evasion and funding weapons programs.

TTPs (Tactics, Techniques, Procedures)

This campaign demonstrates supply chain compromise tactics (T1195.002 - Compromise Software Supply Chain) through the deployment of typosquatted npm packages "rollup-packages-polyfill-core" and "rollup-runtime-polyfill-core" that impersonate the legitimate "rollup-plugin-polyfill-node" project. The malicious packages employ masquerading techniques (T1036 - Masquerading) by mimicking legitimate tooling metadata and descriptions to evade detection. Primary objectives include credential theft (T1552 - Unsecured Credentials) targeting developer secrets and establishing remote access (T1219 - Remote Access Software) to compromised developer environments. The attack vector leverages developer trust in the npm ecosystem and targets the software development lifecycle at the build/dependency management phase.

Targets & Patterns

Lazarus specifically targets software developers and the software development sector in this campaign. The choice of npm package typosquatting indicates focus on JavaScript/Node.js developers who rely on build tools and polyfill libraries. This targeting pattern aligns with Lazarus's broader strategy of compromising software supply chains to gain access to downstream victims, including cryptocurrency platforms, financial services, and technology companies. Developers represent high-value targets due to their privileged access to source code repositories, production environments, API keys, and cryptographic secrets. The use of build tool impersonation suggests intent to compromise developer workstations and CI/CD pipelines, enabling persistent access and potential downstream supply chain attacks against the developers' employers or customers.

Historical Context

This campaign continues Lazarus's established pattern of supply chain attacks targeting the software development ecosystem. The group has previously conducted similar operations including Operation Dream Job (targeting developers through fake job offers), the 3CX supply chain compromise (2023), and multiple campaigns targeting cryptocurrency developers through trojanized tools and libraries. Lazarus has demonstrated consistent interest in compromising developer environments as initial access vectors for broader intrusions, particularly against cryptocurrency exchanges and blockchain platforms. The use of npm package typosquatting follows industry-wide trends of dependency confusion and package impersonation attacks, but Lazarus's involvement elevates the threat due to the group's sophisticated post-exploitation capabilities and strategic objectives beyond typical cybercrime.

Defensive Recommendations

  • Implement npm package verification controls including dependency pinning, lock file integrity checks, and use of private registries with approved package allowlists
  • Deploy endpoint detection rules monitoring for suspicious Node.js child process execution, particularly npm install/postinstall script behaviors (T1195.002)
  • Conduct regular audits of project dependencies using tools like npm audit, Snyk, or Socket to identify typosquatting attempts and known malicious packages
  • Enforce least-privilege access for developer workstations and isolate build environments from production secrets using secret management solutions and ephemeral credentials
  • Monitor for unauthorized outbound connections from developer systems and CI/CD pipelines, particularly to uncommon or newly registered domains associated with package downloads

---

# Geopolitical Context

Geopolitical Context

The deployment of malicious npm packages attributed to North Korea-linked Lazarus group represents a continuation of Pyongyang's strategic use of cyber operations to generate revenue and collect intelligence. Supply chain attacks targeting the software development ecosystem align with the Democratic People's Republic of Korea's documented pattern of exploiting open-source repositories to compromise developer environments, exfiltrate credentials, and establish persistent access for subsequent operations. This activity is consistent with North Korea's broader cyber strategy, which leverages technical operations to circumvent international sanctions and fund state priorities, including weapons programs. The targeting of npm—a critical node in the JavaScript development supply chain—demonstrates sophisticated understanding of modern software workflows and the potential for cascading compromise across downstream users and organizations.

State Actor Alignment

The malicious packages are attributed to threat actors linked to North Korea, specifically the Lazarus group, which operates under the Reconnaissance General Bureau, Pyongyang's primary foreign intelligence service. Lazarus has been subject to U.S. Treasury Department sanctions and is designated under multiple international sanctions regimes for malicious cyber activity, including the 2014 Sony Pictures breach, the 2017 WannaCry ransomware campaign, and numerous cryptocurrency thefts generating hundreds of millions of dollars. The group's supply chain operations targeting developers are consistent with UN Panel of Experts reporting on North Korea's use of cyber capabilities to evade sanctions and generate illicit revenue. This incident aligns with advisories from CISA, FBI, and international partners warning of DPRK targeting of blockchain and software firms.

Business Impacty pro region

The compromise of npm packages has global implications given the ubiquity of JavaScript in modern software development across North America, Europe, and Asia-Pacific. European technology firms and startups relying on npm for dependency management face potential exposure if developers inadvertently installed the malicious packages. The incident underscores vulnerabilities in open-source supply chains that transcend national borders, complicating attribution enforcement and incident response coordination. For allied governments, the activity reinforces the need for enhanced supply chain security frameworks, including the EU's proposed Cyber Resilience Act and similar U.S. initiatives. The targeting of developer credentials may enable follow-on operations against financial services, cryptocurrency platforms, and defense contractors globally, sectors previously targeted by DPRK actors for financial gain and espionage.

Forecast

If North Korea-linked actors continue to refine supply chain targeting techniques, the frequency and sophistication of malicious package deployments across npm, PyPI, and other repositories is likely to increase. Should international sanctions enforcement remain inconsistent, Pyongyang's reliance on cyber-enabled revenue generation will likely persist, driving further investment in developer-focused intrusion capabilities. If the software development community does not adopt enhanced package verification and dependency auditing practices, the risk of widespread credential theft and downstream compromise will remain elevated. Conversely, if repository maintainers implement stricter vetting and anomaly detection, the operational cost for DPRK actors may increase, potentially shifting tactics toward more targeted spear-phishing or watering hole attacks against developer communities.