North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets

Threat actors tied to North Korea uploaded malicious npm packages masquerading as Rollup polyfill tooling that install second-stage payloads from remote hosts; the multi-stage JavaScript malware provides remote-access and data-theft capabilities (credential and wallet theft, file collection, screenshots, remote mouse/keyboard control) and specifically targets developer workstations and CI environments. The report lists affected package names, observed infrastructure (including IPs), similarities to prior Lazarus-linked campaigns, and recommends removing packages, assuming compromise, rotating credentials, blocking egress, and enabling dependency scanning.