North Korean threat actors are using malicious npm packages that mimic Rollup polyfill tooling to steal developer secrets. Learn how the attack works and how to protect yourself.
If you're a developer using npm packages, you just became the target of a sophisticated attack. Threat actors with ties to North Korea are now distributing malicious npm packages that look exactly like legitimate Rollup polyfill tooling. Their goal? To gain remote access to your system and steal your most sensitive data.
Security researchers at JFrog recently uncovered two packages: "rollup-packages-polyfill-core" and "rollup-runtime-polyfill-core." These packages copy everything from the real "rollup-plugin-polyfill-node" project—the description, repository metadata, and even the version numbers. It's a textbook case of typosquatting, but with a dangerous twist.
### How the Attack Works
The attackers didn't just copy the package name and hope for the best. They went all in. The malicious packages include the same functionality as the real one, but with hidden code that executes on installation. Once installed, the package establishes a remote connection to a command-and-control server controlled by the attackers. From there, they can execute commands, exfiltrate environment variables, steal API keys, and access private repositories.
Here's what makes this especially dangerous:
- The packages are designed to blend in with legitimate development workflows.
- They use the same repository URLs and author names to avoid suspicion.
- The malicious code is obfuscated and only activates under specific conditions, making it harder to detect.
- They target developers working on sensitive projects, including those in the cryptocurrency and blockchain space.
### Why Developers Are Prime Targets
Developers hold the keys to the kingdom. Your npm tokens, SSH keys, and cloud credentials are worth a fortune on the black market. North Korean threat actors have been increasingly focused on supply chain attacks, and this latest campaign shows they're getting better at it. By compromising a single developer's machine, they can gain access to entire organizations.
"The attackers are betting that developers will install these packages without thinking twice," says Emily Davis, Head of Digital Privacy and Antidetect Browser Solutions at Antidetectbrowsershub. "They're counting on the trust we place in package registries and the pressure to move fast."
### How to Protect Yourself
Staying safe requires a mix of vigilance and smart tooling. Here are a few steps you can take right now:
- Double-check package names before installing. Look for subtle misspellings or extra hyphens.
- Use package lockfiles and verify checksums whenever possible.
- Run npm audit regularly to identify known vulnerabilities.
- Consider using a sandboxed environment or antidetect browser for sensitive development work.
- Monitor your system for unusual outbound connections.
### The Bigger Picture
This attack is part of a larger trend. Supply chain attacks have become the weapon of choice for state-sponsored groups because they offer high impact with relatively low effort. The npm ecosystem, with its millions of packages and automated installs, is particularly vulnerable. As developers, we need to shift from "trust by default" to "verify always."
The good news is that JFrog has already reported these packages to npm, and they've been removed. But the attackers will likely try again with new names and variations. The key is to stay informed and never assume a package is safe just because it's popular or well-reviewed.
### Final Thoughts
This isn't just about protecting your code—it's about protecting your career and your clients. A single compromised package can lead to a data breach that costs millions of dollars in damages and reputational harm. Take the time to vet every dependency you install. It might slow you down for a minute, but it could save you weeks of cleanup later.
Stay sharp, stay skeptical, and keep your digital environment clean. If you're working with sensitive data, consider using tools that add an extra layer of anonymity and protection to your online activities.
