North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets

Threat actors linked to North Korea have created malicious npm packages that disguise themselves as Rollup polyfill tooling. These packages, named "rollup-packages-polyfill-core" and "rollup-runtime-polyfill-core", closely resemble the legitimate "rollup-plugin-polyfill-node" project in terms of description, repository metadata, and other details. The goal of these packages is to enable remote access and steal sensitive information from developers. The malicious packages were identified by JFrog, which uncovered their similarities to the legitimate Rollup project. The discovery highlights the threat actors' efforts to blend in with legitimate packages to achieve their malicious goals.