Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

JFrog Security uncovered a supply-chain npm campaign where six lookalike Rollup polyfill packages install multi-stage malware that exfiltrates credentials and crypto-wallet data and provides remote-control capabilities; JFrog attributes the campaign to the Lazarus group by TTP similarity, noting staged loaders, sandbox evasion, and an active C2 (216.126.236.244) with some malicious packages still live at report time.