Lazarus-Linked npm Malware Masquerades as Rollup Polyfills (rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect, react-icon-svgs)

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills (TL-2026-1030), also tracked as Rollup Polyfill npm Masquerade Campaign, is a high-severity supply-chain compromise, first published 2026-07-01 and last reviewed 2026-08-13. It is attributed to Lazarus Group (North Korea) with medium confidence, affects npm rollup-packages-polyfill-core, maps to 34 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 33 indicators of compromise.

Key facts for TL-2026-1030

Threat ID
TL-2026-1030
Also known as
Rollup Polyfill npm Masquerade Campaign
Severity
HIGH
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-07-01
Last reviewed
2026-08-13
Attribution
Lazarus Group
Attribution confidence
MEDIUM
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
technology, softwaredevelopment, finance, cryptocurrency
Target regions
Global
Detection rules
9
Indicators of compromise
33
Updates
2026-08-13 · 2 updates

Malware and tooling in Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

Malware and tooling: JADESNOW, PylangGhost, @nut-tree-fork/nut-js, node-pty, screenshot-desktop, ssh2

JFrog Security Research (Yair Benamou) identified six malicious npm packages masquerading as Rollup polyfill utilities, attributed to the North Korea-linked Lazarus threat actor group. The packages hide install-time execution behind benign-looking function names, install second-stage helper packages without saving them to package.json, fetch AES-256-CBC encrypted payloads from a JSONKeeper paste, and deploy a multi-stage credential-theft and remote-access toolkit against JavaScript/Node.js developers.

How Lazarus-Linked npm Malware Masquerades as Rollup Polyfills works

On 2026-06-30, JFrog Security Research published findings on a Lazarus-linked npm supply-chain campaign in which malicious packages impersonate legitimate Rollup polyfill libraries. The identified packages are rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect, and react-icon-svgs. The malicious logic is appended to otherwise plausible, functioning Rollup plugin code, with the entry-point trigger hidden behind an innocuous-sounding function such as ValidateSvgModule(). Only the CommonJS entry point (dist/index.js) is backdoored; ESM variants are left clean, likely to reduce detection surface in bundler-based scanning.

At import time, the backdoored entry point decodes base64-encoded npm install commands (e.g. npm install swift-parse-stream --no-save --silent --no-audit --no-fund, npm install quirky-token --no-save --silent --no-audit --no-fund) to silently pull in second-stage 'SVG utility' packages without touching package.json, evading dependency-review tooling. These second-stage packages fetch a JSON blob from a JSONKeeper paste (https://www.jsonkeeper.com/b/3P9BF) containing an AES-256-CBC-encrypted payload, decrypted using a hardcoded key derived via crypto.scryptSync('98cb54c0b4ac259d30c9c1ca1ae87c68', 'salt', 32). The decrypted first-stage payload (~114 KB) in turn downloads a launcher module named 'pack', which spawns further specialized modules: scdata, ldata, a file collector, and a clipboard monitor.

Before executing, the payload performs extensive sandbox/CI/cloud evasion checks, exiting if it detects environment variables such as CODESPACE_NAME, CODESANDBOX_HOST, VERCEL, AWS_EXECUTION_ENV, AWS_REGION, AWS_LAMBDA_FUNCTION_NAME, AWS_ACCESS_KEY_ID, GOOGLE_CLOUD_PROJECT, AZURE_FUNCTIONS_ENVIRONMENT, DOCKER, RENDER, GAE_ENV, WEBSITE_SITE_NAME, DYNO, or SOCKET_DEV, and by fingerprinting virtualization via CIM queries, system_profiler, /proc/cpuinfo, and known hypervisor strings (vmware, virtualbox, qemu). Single-instance execution is tracked with a marker file at <tmp>/.npm/vhost.ctl.

Once active, the malware collects browser-stored login credentials and extension storage, cryptocurrency wallet data (MetaMask and other extensions), sensitive developer files (.env, .pem, .key, SSH keys, cloud credential files under .aws/.azure/.ssh/.gnupg/.vscode), editor history from VS Code, Windsurf, and Cursor, clipboard contents (credentials, tokens, seed phrases), and macOS keychain data. It also establishes remote-access capability via node-pty (spawning PowerShell on Windows or zsh elsewhere), ssh2-based SSH sessions, screenshot capture on Windows via screenshot-desktop, keyboard/mouse control on Windows via @nut-tree-fork/nut-js, arbitrary command execution through child_process.exec, and clipboard read/paste handling.

Command-and-control is centralized on 216.126.236.244, using a REST-like API namespace (/api/service/...), a dedicated remote-access port (4801), and separate upload/collection ports (4806/upload, 4809/upload, 4809/cldbs) — a layered infrastructure design consistent with prior Lazarus npm campaigns. JFrog explicitly notes the layered package structure, lookalike naming, legitimate-looking metadata, hidden install-time execution, environment checks, and credential-theft/remote-access payloads are 'similar to previous North Korean Lazarus-linked npm campaigns,' including two other JFrog-tracked incidents from the same week: a PostCSS-masquerading campaign delivering the PylangGhost Windows RAT (2026-06-22), and a hijacked-package campaign (html-to-gutenberg, fetch-page-assets) using a novel VS Code autorun task plus blockchain (Tron/Aptos/BSC) dead-drop C2 resolution to deliver a Python credential/crypto stealer, dubbed JADESNOW in reporting, with its own C2 set (166.88.134.62, 198.105.127.210, 23.27.202.27) and Telegram-bot exfiltration channel.

No CVE applies (this is a malicious-package/social-engineering supply-chain attack, not a software vulnerability). No public file hashes were disclosed in the primary report.

MITRE ATT&CK techniques used in TL-2026-1030

Collection

T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1115 Clipboard Data

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Discovery

T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1571 Non-Standard Port; T1573 Encrypted Channel

Credential Access

T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Initial Access

T1195 Supply Chain Compromise; T1199 Trusted Relationship

Persistence

T1505 Server Software Component

Resource Development

T1584 Compromise Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities

Impact

T1657 Financial Theft

Affected products and versions in Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

  • npm — rollup-packages-polyfill-core
    Vulnerable versions: all published versions (XRAY-1008625)
    Fixed in: package removed from npm registry
  • npm — rollup-runtime-polyfill-core
    Vulnerable versions: all published versions (XRAY-1008531)
    Fixed in: package removed from npm registry
  • npm — swift-parse-stream
    Vulnerable versions: all published versions (XRAY-1005725)
    Fixed in: package removed from npm registry
  • npm — quirky-token
    Vulnerable versions: all published versions (XRAY-1003392)
    Fixed in: package removed from npm registry
  • npm — rollup-plugin-polyfill-connect
    Vulnerable versions: all published versions (XRAY-973019)
    Fixed in: package removed from npm registry
  • npm — react-icon-svgs
    Vulnerable versions: all published versions (XRAY-1011624)
    Fixed in: package removed from npm registry

Remediation for Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

Immediate actions

  • Remove rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect, and react-icon-svgs from any project dependency trees and lockfiles.
  • Block outbound traffic to 216.126.236.244 (ports 4801, 4806, 4809) and to jsonkeeper.com paste b/3P9BF at the network perimeter and in CI runners.
  • Rotate all credentials, SSH keys, cloud (.aws/.azure/.gnupg) tokens, and browser-saved passwords on any developer workstation or CI runner that resolved one of the flagged packages.
  • Audit npm install logs / lockfile diffs for --no-save silent installs of swift-parse-stream or quirky-token that would not appear in package.json.

Workarounds

  • Pin dependency versions and disable automatic transitive-dependency resolution for Rollup-adjacent packages until vetted.
  • Run npm install with --ignore-scripts in CI and sandbox any project directory before opening in VS Code.

Longer-term hardening

  • Enforce dependency allow-listing and provenance verification (npm provenance, Sigstore) for all new package installs in CI/CD.
  • Deploy egress filtering and DNS monitoring on developer endpoints and build agents to detect anomalous outbound connections during npm install.
  • Adopt automated malicious-package scanning (Socket.dev, JFrog Xray, OpenSSF Package Analysis) as a pre-merge/pre-publish CI gate.
  • Restrict VS Code workspace trust and auto-run tasks (runOn: folderOpen) org-wide given the related JADESNOW VS Code-autorun technique.

Weaknesses (CWE) in Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

CWE-506, CWE-494, CWE-829, CWE-1104

Timeline of Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

  • Related JFrog-tracked Lazarus npm campaign: html-to-gutenberg (4.2.11) and fetch-page-assets (1.2.9) uploaded to npm using VSCode autorun/blockchain dead-drop technique.
  • JFrog publishes report on PostCSS-masquerading npm packages delivering the PylangGhost Windows RAT, attributed to the same Lazarus npm campaign pattern.
  • JFrog publishes 'Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops' report covering html-to-gutenberg/fetch-page-assets and the JADESNOW credential/crypto stealer chain.
  • Nextron Research identifies 16 additional malicious Go packages containing payloads matching the JADESNOW-linked campaign.
  • Primary C2 infrastructure 216.126.236.244 (ports 4801, 4806, 4809) and JSONKeeper paste endpoint (jsonkeeper.com/b/3P9BF) disclosed as staging/C2 for the payload delivery chain.
  • JFrog Security Research (Yair Benamou) publishes 'Lazarus-Linked npm Malware Masquerades as Rollup Polyfills,' identifying six malicious packages: rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect, and react-icon-svgs.
  • Threat ingested into Threadlinqs Intelligence Platform via Malpedia reference feed; RESEARCH phase completed with full JFrog source analysis.
  • Archive.org mirror of the JFrog report captured for long-term reference.

Update history for TL-2026-1030

  • 2026-08-13 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 62 community-related indicator(s).
  • 2026-08-04 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 112 community-related indicator(s).

Sources cited for Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

Threats related to Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

Detection coverage for TL-2026-1030

As of 2026-08-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1030 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1030

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats