# North Korea-Linked Threat Actors Deploy Sophisticated npm Package Trojan Campaign Targeting Developer Secrets
North Korean threat actors have escalated their assault on the software supply chain with a new wave of malicious npm packages designed to harvest developer credentials, source code, and sensitive configuration files from compromised workstations. The campaign, detailed by security firm JFrog, demonstrates an alarming refinement in supply chain attack techniques, utilizing multi-stage payloads and sophisticated evasion mechanisms to bypass detection and analysis.
## The Threat
Security researchers have identified two primary malicious npm packages serving as entry points for the attack:
These packages are carefully crafted to impersonate the legitimate rollup-plugin-polyfill-node project, copying its description, repository metadata, and package structure to evade detection during routine dependency reviews. According to JFrog's analysis, the packages were designed to exploit the visual similarity to legitimate Rollup tooling, placing themselves in the same naming namespace that developers expect to find polyfill utilities.
The attack chain involves six malicious packages operating in coordinated stages:
| Package Name | Primary Role | Secondary Payload |
|---|---|---|
| rollup-packages-polyfill-core | Entry point | Installs swift-parse-stream |
| rollup-runtime-polyfill-core | Entry point | Installs quirky-token |
| react-icon-svgs | Second stage | Installs rollup-plugin-polyfill-connect |
| swift-parse-stream | Payload delivery | Fetches JSON from JSONKeeper |
| quirky-token | Payload delivery | Fetches JSON from JSONKeeper |
| rollup-plugin-polyfill-connect | Payload delivery | Executes remote code |
All six packages have been removed from the npm registry following disclosure.
## Background and Context
This campaign represents the latest chapter in an ongoing North Korean cyber operation traced to the Lazarus Group, a state-sponsored threat actor known for high-profile intrusions including the Sony Pictures hack and numerous cryptocurrency theft operations.
A Pattern of Escalation:
The threat landscape for npm has deteriorated significantly over the past year. In April 2026, security researchers at Panther uncovered a massive North Korean campaign involving 108 malicious npm packages spanning 261 versions, designed to deliver two known malware families: BeaverTail and OtterCookie. That sustained campaign included packages like "rollup-plugin-polyfill-route," published on March 20, 2026—making the current wave not an isolated incident but evidence of a prolonged, focused effort to compromise developer environments.
The Lazarus Group's historical preference for npm as an attack vector reflects a strategic calculation: developers install packages with minimal scrutiny, CI/CD pipelines often run with elevated privileges, and developer workstations frequently contain the crown jewels of modern software—source code, API keys, and credentials for cloud platforms.
## Technical Details
The attack employs a layered architecture designed to frustrate detection and execution in analysis environments.
Stage 1: Deceptive Installation
When a developer or automated system installs "rollup-packages-polyfill-core" or "rollup-runtime-polyfill-core," the npm install script executes a Base64-encoded command that retrieves and installs a second-stage package ("swift-parse-stream" or "quirky-token"). This two-step installation obfuscates the true nature of the packages and delays the download of the actual payload until installation time.
Stage 2: Environment Detection and Evasion
The second-stage packages—disguised as SVG sanitization utilities—incorporate sophisticated environment detection routines. Before executing the malicious payload, the code performs checks to determine whether it's running in:
This gating mechanism ensures the malware only activates on genuine developer machines, preventing it from detonating in controlled analysis environments where security researchers can study its behavior.
Stage 3: Payload Delivery and Execution
Upon clearing environment checks, the packages connect to JSONKeeper (a pastebin-like service) to retrieve additional JavaScript code, which is immediately evaluated using JavaScript's eval() function. The retrieved payload then contacts an external command-and-control server (216.126.236[.]244) to download an encrypted JavaScript loader.
Once decrypted, this loader enables a comprehensive suite of capabilities:
### Remote Access and Control
### Data Exfiltration
The malware systematically collects:
Developer Credentials and Configurations:
Browser and Financial Assets:
Operational Intelligence:
## Implications
The scope and sophistication of this campaign represents a critical escalation in supply chain risk for software development organizations.
### Direct Risks
Developers as Entry Points: Unlike traditional infrastructure security, developer workstations are often the weakest link in security-conscious organizations. A single compromised npm package can grant adversaries access to production credentials, source repositories, and deployment pipelines.
Credential Harvesting at Scale: The specific targeting of API keys for major cloud providers (AWS, Azure, Google Cloud) and AI platforms (Anthropic Claude, Google Gemini) suggests the threat actors are harvesting credentials for use in subsequent intrusions, lateral movement, or sale on underground markets.
Persistent Access: The remote access capabilities (terminal sessions, command execution, input simulation) enable attackers to establish long-term persistence on developer machines, potentially remaining undetected for months while harvesting intellectual property.
### Systemic Implications
Supply Chain Fragility: The npm ecosystem contains over 2 million packages, the majority maintained by volunteer developers with minimal security oversight. Each package represents a potential attack surface; a single compromised dependency can propagate across thousands of applications.
State-Sponsored Targeting: The Lazarus Group's sustained focus on npm indicates that state-sponsored actors view software supply chain compromise as a high-value operation worthy of sustained investment and sophistication. This mirrors the operational patterns seen in nation-state cyberespionage campaigns.
## Recommendations
Organizations and individual developers must implement layered defenses to mitigate npm supply chain risk:
### For Developers
package-lock.json and npm ci (instead of npm install) to prevent automatic updates to new versions, reducing the window for malicious package injection..npmrc configuration to limit the scope of what npm scripts can access (disable lifecycle scripts for untrusted packages when possible).### For Organizations
---
## HackWire Analysis
The targeting of Anthropic Claude, Google Gemini, and Foundry configurations in this campaign signals a fundamental shift in adversary interest: North Korean threat actors are now actively seeking to compromise AI model access and developer workflows that integrate generative AI.
This matters because API keys to frontier AI models represent both immediate financial value and longer-term intelligence collection opportunities. An attacker with access to a developer's Claude API key can:
The pattern here is unmistakable: this is not a generic malware campaign opportunistically harvesting any credentials. The specific focus on dev tool configurations—VS Code, Cursor, Windsurf—combined with targeted collection of AI platform credentials, suggests reconnaissance for deeper supply chain compromise. An attacker who controls a developer's workstation and access to their AI tooling can automate the generation of backdoor-laden code, malicious documentation, or compromised SDK packages, multiplying the attack surface exponentially.
Critically, the April 2026 campaign published 261 package versions across just 108 unique names. We're not seeing a handful of experimental packages; we're seeing industrialized supply chain attack infrastructure. Each variant likely served to evade emerging detections or target specific victim profiles. The fact that we're now seeing a "fresh wave" (as JFrog describes it) with overlapping tactics suggests the April detections merely disrupted one campaign cycle, not the underlying operation.
Developers should assume that if they installed any Rollup-adjacent package between March and July 2026, credential auditing is warranted. Organizations should treat this as an escalation point: North Korean state actors have demonstrated they will build and maintain industrial-scale npm attack campaigns. Dependency sprawl is no longer a hygiene issue—it's a nation-state targeting vector.
— HackWire Editorial
---
## Related Coverage