Lazarus-Linked npm Malware Masquerades as Rollup Polyfills (rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect, react-icon-svgs) — Threadlinqs Intelligence
As of 2026-07-01, Lazarus-Linked npm Malware Masquerades as Rollup Polyfills (rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect, react-icon-svgs) is a high-severity supply chain threat attributed to Lazarus Group (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 33 indicators of compromise.
Threat ID: TL-2026-1030 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Lazarus Group · North Korea · FINANCIAL
JFrog Security Research (Yair Benamou) identified six malicious npm packages masquerading as Rollup polyfill utilities, attributed to the North Korea-linked Lazarus threat actor group. The packages
On 2026-06-30, JFrog Security Research published findings on a Lazarus-linked npm supply-chain campaign in which malicious packages impersonate legitimate Rollup polyfill libraries. The identified packages are rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect, and react-icon-svgs. The malicious logic is appended to otherwise plausible, functioning Rollup plugin code, with the entry-point trigger hidden behind an innocuous-sounding function such as ValidateSvgModule(). Only the CommonJS entry point (dist/index.js) is backdoored; ESM variants are left clean, likely to reduce detection surface in bundler-based scanning.
At import time, the backdoored entry point decodes base64-encoded npm install commands (e.g. npm install swift-parse-stream --no-save --silent --no-audit --no-fund, npm install quirky-token --no-save --silent --no-audit --no-fund) to silently pull in second-stage 'SVG utility' packages without touching package.json, evading dependency-review tooling. These second-stage packages fetch a JSON blob from a JSONKeeper paste (https://www.jsonkeeper.com/b/3P9BF) containing an AES-256-CBC-encrypted payload, decrypted using a hardcoded key derived via crypto.scryptSync('98cb54c0b4ac259d30c9c1ca1ae87c68', 'salt', 32). The decrypted first-stage payload (~114 KB) in turn downloads a launcher module named 'pack', which spawns further specialized modules: scdata, ldata, a file collector, and a clipboard monitor.
Before executing, the payload performs extensive sandbox/CI/cloud evasion checks, exiting if it detects environment variables such as CODESPACE_NAME, CODESANDBOX_HOST, VERCEL, AWS_EXECUTION_ENV, AWS_REGION, AWS_LAMBDA_FUNCTION_NAME, AWS_ACCESS_KEY_ID, GOOGLE_CLOUD_PROJECT, AZURE_FUNCTIONS_ENVIRONMENT, DOCKER, RENDER, GAE_ENV, WEBSITE_SITE_NAME, DYNO, or SOCKET_DEV, and by fingerprinting virtualization via CIM queries, system_profiler, /proc/cpuinfo, and known hypervisor strings (vmware, virtualbox, qemu). Single-instance execution is tracked with a marker file at <tmp>/.npm/vhost.ctl.
Once active, the malware collects browser-stored login credentials and extension storage, cryptocurrency wallet data (MetaMask and other extensions), sensitive developer files (.env, .pem, .key, SSH keys, cloud credential files under .aws/.azure/.ssh/.gnupg/.vscode), editor history from VS Code, Windsurf, and Cursor, clipboard contents (credentials, tokens, seed phrases), and macOS keychain data. It also establishes remote-access capability via node-pty (spawning PowerShell on Windows or zsh elsewhere), ssh2-based SSH sessions, screenshot capture on Windows via screenshot-desktop, keyboard/mouse control on Windows via @nut-tree-fork/nut-js, arbitrary command execution through child_process.exec, and clipboard read/paste handling.
Command-and-control is centralized on 216.126.236.244, using a REST-like API namespace (/api/service/...), a dedicated remote-access port (4801), and separate upload/collection ports (4806/upload, 4809/upload, 4809/cldbs) — a layered infrastructure design consistent with prior Lazarus npm campaigns. JFrog explicitly notes the layered package structure, lookalike naming, legitimate-looking metadata, hidden install-time execution, environment checks, and credential-theft/remote-access payloads are 'similar to previous North Korean Lazarus-linked npm campaigns,' including two other JFrog-tracked incidents from the same week: a PostCSS-masquerading campaign delivering the PylangGhost Windows RAT (2026-06-22), and a hijacked-package campaign (html-to-gutenberg, fetch-page-assets) using a novel VS Code autorun task plus blockchain (Tron/Aptos/BSC) dead-drop C2 resolution to deliver a Python credential/crypto stealer, dubbed JADESNOW in reporting, with its own C2 set (166.88.134.62, 198.105.127.210, 23.27.202.27) and Telegram-bot exfiltration channel.
No CVE applies (this is a malicious-package/social-engineering supply-chain attack, not a s
Weaknesses (CWE)
CWE-506, CWE-494, CWE-829, CWE-1104
Target sectors: technology, softwaredevelopment, finance, cryptocurrency
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 33 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1584, T1587, T1585, T1195, T1199, T1059, T1059, T1059, T1059, T1204