North Korea-Linked Actors Use Fake Rollup npm Packages to Steal Developer Secrets
Summary
JFrog identified fake Rollup polyfill npm packages that use staged payloads to provide remote access and steal developer credentials, files, browser data, and cryptocurrency wallet information. The packages have been removed from npm.
Key points
- The packages rollup-packages-polyfill-core and rollup-runtime-polyfill-core impersonated legitimate Rollup polyfill tooling and concealed install-time commands for second-stage packages.
- Second-stage packages fetch a JSON object from JSONKeeper and execute its model field; the malware checks for cloud development, sandbox, serverless, and analysis environments.
- After those checks, the malware retrieves an encrypted JavaScript payload from 216.126.236[.]244.
- The payload supports remote terminal sessions, command execution, screenshots, input control, and theft of browser and cryptocurrency wallet data, files, and clipboard contents.
- The file collector targets developer tool histories and configurations, including VS Code, Windsurf, Cursor, AWS, Azure, SSH, and Zsh.
- The packages have been removed from npm. Users who installed them are advised to assume compromise, rotate credentials, block malicious egress, and enable CI/CD dependency scanning.
Article Details
- Attack Vectors
- Fake npm packages mimicked Rollup polyfill tooling and concealed Base64-encoded install commands that triggered staged package execution.
- Second-stage packages fetched a JSON object from JSONKeeper and evaluated its model field; the resulting JavaScript checked for analysis and cloud-development environments before fetching an encrypted payload from an external server.
- The payload enabled remote terminal sessions, command execution, screenshots, clipboard capture, and theft of browser data, developer secrets, and files.
- Defensive Notes
- Remove the listed packages from workstations where they were installed, assume compromise, and rotate credentials.
- Block the malicious egress channels and enable dependency scanning in CI/CD pipelines to flag newly published or suspicious packages.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 216[.]126[.]236[.]244 | External server contacted by the malware to retrieve an encrypted JavaScript payload. |
MITRE ATT&CK
T1005 · Data from Local SystemThe payload collected files matching specified extensions and sought editor history and developer-tool configuration files.T1027 · Obfuscated Files or InformationA Base64-encoded npm install command was concealed in the first-stage packages.T1041 · Exfiltration Over C2 ChannelThe PyPI backdoor exfiltrated command-execution results via Telegram.T1059.004 · Unix ShellThe PyPI backdoor could execute attacker-sent shell commands.T1059.006 · PythonThe PyPI backdoor described in the article could run arbitrary Python code sent by the attacker.T1059.007 · JavaScriptThe package stages fetched and evaluated JavaScript, and the payload used JavaScript for execution.T1105 · Ingress Tool TransferThe malware fetched an encrypted JavaScript payload from an external server.T1113 · Screen CaptureThe main payload could capture screenshots of the compromised host.T1115 · Clipboard DataThe main payload periodically captured clipboard content.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious npm packages impersonated Rollup polyfill tooling and delivered payloads through package dependencies.T1497.001 · System ChecksThe JavaScript checked for cloud development environments, sandboxes, serverless runtimes, and analysis infrastructure to avoid execution.T1552.001 · Credentials In FilesThe campaigns collected credentials and secrets from files such as SSH keys, cloud credentials, and developer configuration files.T1555.003 · Credentials from Web BrowsersThe payload stole data from web browsers, including browser credentials.
People
Threat Actors
Malware
Vendors
Amazon Web ServicesVisual Studio Code, Windsurf, and Cursor, along with developer and AI tool configurations, such as AWS, Microsoft Azure, Google Gemini, Anthropic Claude, Foundry, SSH, and Z shell (Zsh).AnthropicCursor, along with developer and AI tool configurations, such as AWS, Microsoft Azure, Google Gemini, Anthropic Claude, Foundry, SSH, and Z shell (Zsh).GoogleWindsurf, and Cursor, along with developer and AI tool configurations, such as AWS, Microsoft Azure, Google Gemini, Anthropic Claude, Foundry, SSH, and Z shell (Zsh).MicrosoftThe file collector component has been found to specifically look for editor history associated with Microsoft Visual Studio Code, Windsurf, and Cursor, along with developer and AI tool configurations, such as AWS,
Products
Claudealong with developer and AI tool configurations, such as AWS, Microsoft Azure, Google Gemini, Anthropic Claude, Foundry, SSH, and Z shell (Zsh).Cursorfound to specifically look for editor history associated with Microsoft Visual Studio Code, Windsurf, and Cursor, along with developer and AI tool configurations, such as AWS, Microsoft Azure, Google Gemini, AnthropicGoogle GeminiWindsurf, and Cursor, along with developer and AI tool configurations, such as AWS, Microsoft Azure, Google Gemini, Anthropic Claude, Foundry, SSH, and Z shell (Zsh).JSONKeeperSecond-stage components fetched and executed JavaScript from JSONKeeper.npmNorth Korean-linked threat actors have been using fake Rollup polyfill npm packages to deliver layered malware that enables remote access, credential theft, and data collection from developer environments.PyPISimilar npm and PyPI supply chain attacks also targeted credentials and secrets.RollupNorth Korean-linked threat actors have been using fake Rollup polyfill npm packages to deliver layered malware that enables remote access, credential theft, and data collection from developer environments.VSCodecollector component has been found to specifically look for editor history associated with Microsoft Visual Studio Code, Windsurf, and Cursor, along with developer and AI tool configurations, such as AWS, MicrosoftWindsurfhas been found to specifically look for editor history associated with Microsoft Visual Studio Code, Windsurf, and Cursor, along with developer and AI tool configurations, such as AWS, Microsoft Azure, Google