# Lazarus-Linked npm Malware Masquerades as Rollup Polyfills (rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect, react-icon-svgs)

> JFrog Security Research (Yair Benamou) identified six malicious npm packages masquerading as Rollup polyfill utilities, attributed to the North Korea-linked Lazarus threat actor group. The packages hide install-time execution behind benign-looking function names, install second-stage helper packages without saving them to package.json, fetch AES-256-CBC encrypted payloads from a JSONKeeper paste, and deploy a multi-stage credential-theft and remote-access toolkit against JavaScript/Node.js developers.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-08-13T10:33:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1030
- **ID:** TL-2026-1030
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Lazarus Group (North Korea)
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-06-30, JFrog Security Research published findings on a Lazarus-linked npm supply-chain campaign in which malicious packages impersonate legitimate Rollup polyfill libraries. The identified packages are rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect, and react-icon-svgs. The malicious logic is appended to otherwise plausible, functioning Rollup plugin code, with the entry-point trigger hidden behind an innocuous-sounding function such as ValidateSvgModule(). Only the CommonJS entry point (dist/index.js) is backdoored; ESM variants are left clean, likely to reduce detection surface in bundler-based scanning.

At import time, the backdoored entry point decodes base64-encoded npm install commands (e.g. npm install swift-parse-stream --no-save --silent --no-audit --no-fund, npm install quirky-token --no-save --silent --no-audit --no-fund) to silently pull in second-stage 'SVG utility' packages without touching package.json, evading dependency-review tooling. These second-stage packages fetch a JSON blob from a JSONKeeper paste (https://www.jsonkeeper.com/b/3P9BF) containing an AES-256-CBC-encrypted payload, decrypted using a hardcoded key derived via crypto.scryptSync('98cb54c0b4ac259d30c9c1ca1ae87c68', 'salt', 32). The decrypted first-stage payload (~114 KB) in turn downloads a launcher module named 'pack', which spawns further specialized modules: scdata, ldata, a file collector, and a clipboard monitor.

Before executing, the payload performs extensive sandbox/CI/cloud evasion checks, exiting if it detects environment variables such as CODESPACE_NAME, CODESANDBOX_HOST, VERCEL, AWS_EXECUTION_ENV, AWS_REGION, AWS_LAMBDA_FUNCTION_NAME, AWS_ACCESS_KEY_ID, GOOGLE_CLOUD_PROJECT, AZURE_FUNCTIONS_ENVIRONMENT, DOCKER, RENDER, GAE_ENV, WEBSITE_SITE_NAME, DYNO, or SOCKET_DEV, and by fingerprinting virtualization via CIM queries, system_profiler, /proc/cpuinfo, and known hypervisor strings (vmware, virtualbox, qemu). Single-instance execution is tracked with a marker file at <tmp>/.npm/vhost.ctl.

Once active, the malware collects browser-stored login credentials and extension storage, cryptocurrency wallet data (MetaMask and other extensions), sensitive developer files (.env, .pem, .key, SSH keys, cloud credential files under .aws/.azure/.ssh/.gnupg/.vscode), editor history from VS Code, Windsurf, and Cursor, clipboard contents (credentials, tokens, seed phrases), and macOS keychain data. It also establishes remote-access capability via node-pty (spawning PowerShell on Windows or zsh elsewhere), ssh2-based SSH sessions, screenshot capture on Windows via screenshot-desktop, keyboard/mouse control on Windows via @nut-tree-fork/nut-js, arbitrary command execution through child_process.exec, and clipboard read/paste handling.

Command-and-control is centralized on 216.126.236.244, using a REST-like API namespace (/api/service/...), a dedicated remote-access port (4801), and separate upload/collection ports (4806/upload, 4809/upload, 4809/cldbs) — a layered infrastructure design consistent with prior Lazarus npm campaigns. JFrog explicitly notes the layered package structure, lookalike naming, legitimate-looking metadata, hidden install-time execution, environment checks, and credential-theft/remote-access payloads are 'similar to previous North Korean Lazarus-linked npm campaigns,' including two other JFrog-tracked incidents from the same week: a PostCSS-masquerading campaign delivering the PylangGhost Windows RAT (2026-06-22), and a hijacked-package campaign (html-to-gutenberg, fetch-page-assets) using a novel VS Code autorun task plus blockchain (Tron/Aptos/BSC) dead-drop C2 resolution to deliver a Python credential/crypto stealer, dubbed JADESNOW in reporting, with its own C2 set (166.88.134.62, 198.105.127.210, 23.27.202.27) and Telegram-bot exfiltration channel.

No CVE applies (this is a malicious-package/social-engineering supply-chain attack, not a software vulnerability). No public file hashes were disclosed in the primary report.

## MITRE ATT&CK

- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1585 Establish Accounts
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1505 Server Software Component
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1036 Masquerading
- T1070 Indicator Removal
- T1082 System Information Discovery
- T1518 Software Discovery
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1113 Screen Capture
- T1056 Input Capture
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1071 Application Layer Protocol
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1571 Non-Standard Port
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Lazarus-Linked npm Malware Masquerades as Rollup Polyfills](https://research.jfrog.com/post/rollup-polyfill-masquerading/)
- [Lazarus-Linked npm Malware Masquerades as Rollup Polyfills (Malpedia reference)](https://malpedia.caad.fkie.fraunhofer.de/library/b22b52ed-2d2c-4c7a-a58b-1bc21983483b/)
- [Archive.org mirror of JFrog Rollup Polyfill Masquerading report](https://web.archive.org/20260701072814/https://research.jfrog.com/post/rollup-polyfill-masquerading/)
- [Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops to Deploy a Credential/Crypto Stealer](https://research.jfrog.com/post/hijacked-npm-vscode-tasks-blockchain/)
- [8 Malicious npm Packages Deliver Multi-Layered Chrome Browser Information Stealer](https://jfrog.com/blog/malicious-npm-packages-chrome-browser-information-stealer/)
- [New compromised packages identified in largest npm attack in history](https://jfrog.com/blog/new-compromised-packages-in-largest-npm-attack-in-history/)
- [Lazarus Strikes npm Again with New Wave of Malicious Packages](https://socket.dev/blog/lazarus-strikes-npm-again-with-a-new-wave-of-malicious-packages)
- [Lazarus Group deceives developers with 6 new malicious npm packages](https://cyberscoop.com/lazarus-group-north-korea-malicious-npm-packages-socket/)
- [Lazarus Campaign Plants Malicious Packages in npm and PyPI Ecosystems](https://thehackernews.com/2026/02/lazarus-campaign-plants-malicious.html)
- [JFrog Security Research - Malicious Packages](https://research.jfrog.com/malicious-packages/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1030