North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets

Summary

Threat actors with ties to North Korea have been linked to a fresh set of malicious npm packages that masquerade as Rollup polyfill tooling to facilitate remote access and data theft. According to JFrog, the packages "rollup-packages-polyfill-core" and "rollup-runtime-polyfill-core" mimic the legitimate "rollup-plugin-polyfill-node" project, down to the description, repository metadata, and

SpinGraph analysis pending — check back after processing.

• 19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges
• Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters
• SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
• New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos
• FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations
• AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack