Fake Rollup npm Packages Target Developer Machines

Another week, another batch of malicious npm packages built to look like something you'd install without thinking about it. JFrog's researchers have flagged two: rollup-packages-polyfill-core and rollup-runtime-polyfill-core, both wearing the clothes of the legitimate rollup-plugin-polyfill-node project. Same description, same repository metadata, same naming conventions. On a quick dependency review, they'd pass.

The packages are part of a larger campaign that researchers link to North Korean threat actors, following the same patterns seen in earlier Lazarus-adjacent operations. Install one and a Base64-encoded command quietly pulls in a second-stage package (swift-parse-stream or quirky-token) that poses as an SVG sanitisation utility. That package fetches a JSON blob from JSONKeeper, evals a field inside it, and reaches out to an external server for an encrypted JavaScript payload. Before doing anything interesting, the malware checks that it isn't running inside a sandbox or a cloud dev environment.

What the payload actually does

Once it's satisfied nobody's watching, the payload gets busy. It opens interactive terminal sessions, captures screenshots, logs keystrokes, and on Windows machines it uses the @nut-tree-fork/nut-js library to move the mouse around. Then it starts hunting for anything valuable on disk:

• Browser data and saved credentials
• Crypto wallets
• SSH keys
• npm authentication tokens
• AWS and Azure credentials
• Config files for AI tools including Claude, Gemini, and Cursor
• Editor history from VS Code and Windsurf

That last one is quietly clever. Editor history tells the intruders what the developer has been working on, which repos matter, and where the good secrets are likely to be sitting.

Why developer machines are such a rich target

The uncomfortable part is what a working developer laptop actually holds. Git credentials, cloud keys, production secrets, half-written scripts with tokens still hardcoded in them, session cookies for admin dashboards. Build servers are worse again. A single npm install run by someone skimming a dependency list is enough to hand all of that over to a stranger.

Typosquatting attacks like this succeed because the review moment is so small. A name that looks right, a description that matches, a repo link that resolves. Nobody diffs the tarball. The registry does not sit between the package author and your machine in any meaningful way, and post-install scripts run with whatever privileges your terminal has.

If you've installed either package

Assume compromise. Rotate anything the workstation had access to: cloud keys, git tokens, npm tokens, SSH keys, wallet seeds if they were on that box. Then look further up the pipeline. If the compromised machine had access to CI runners or build agents, check whether the intruders moved from the laptop into shared infrastructure, because that is where the real damage tends to happen with campaigns like this one.

The registry will pull these two packages down. The next two will be along shortly, under slightly different names.