# North Korea-Linked Threat Actors Deploy Sophisticated npm Package Trojan Campaign Targeting Developer Secrets


North Korean threat actors have escalated their assault on the software supply chain with a new wave of malicious npm packages designed to harvest developer credentials, source code, and sensitive configuration files from compromised workstations. The campaign, detailed by security firm JFrog, demonstrates an alarming refinement in supply chain attack techniques, utilizing multi-stage payloads and sophisticated evasion mechanisms to bypass detection and analysis.


## The Threat


Security researchers have identified two primary malicious npm packages serving as entry points for the attack:


  • rollup-packages-polyfill-core
  • rollup-runtime-polyfill-core

  • These packages are carefully crafted to impersonate the legitimate rollup-plugin-polyfill-node project, copying its description, repository metadata, and package structure to evade detection during routine dependency reviews. According to JFrog's analysis, the packages were designed to exploit the visual similarity to legitimate Rollup tooling, placing themselves in the same naming namespace that developers expect to find polyfill utilities.


    The attack chain involves six malicious packages operating in coordinated stages:


    | Package Name | Primary Role | Secondary Payload |

    |---|---|---|

    | rollup-packages-polyfill-core | Entry point | Installs swift-parse-stream |

    | rollup-runtime-polyfill-core | Entry point | Installs quirky-token |

    | react-icon-svgs | Second stage | Installs rollup-plugin-polyfill-connect |

    | swift-parse-stream | Payload delivery | Fetches JSON from JSONKeeper |

    | quirky-token | Payload delivery | Fetches JSON from JSONKeeper |

    | rollup-plugin-polyfill-connect | Payload delivery | Executes remote code |


    All six packages have been removed from the npm registry following disclosure.


    ## Background and Context


    This campaign represents the latest chapter in an ongoing North Korean cyber operation traced to the Lazarus Group, a state-sponsored threat actor known for high-profile intrusions including the Sony Pictures hack and numerous cryptocurrency theft operations.


    A Pattern of Escalation:


    The threat landscape for npm has deteriorated significantly over the past year. In April 2026, security researchers at Panther uncovered a massive North Korean campaign involving 108 malicious npm packages spanning 261 versions, designed to deliver two known malware families: BeaverTail and OtterCookie. That sustained campaign included packages like "rollup-plugin-polyfill-route," published on March 20, 2026—making the current wave not an isolated incident but evidence of a prolonged, focused effort to compromise developer environments.


    The Lazarus Group's historical preference for npm as an attack vector reflects a strategic calculation: developers install packages with minimal scrutiny, CI/CD pipelines often run with elevated privileges, and developer workstations frequently contain the crown jewels of modern software—source code, API keys, and credentials for cloud platforms.


    ## Technical Details


    The attack employs a layered architecture designed to frustrate detection and execution in analysis environments.


    Stage 1: Deceptive Installation


    When a developer or automated system installs "rollup-packages-polyfill-core" or "rollup-runtime-polyfill-core," the npm install script executes a Base64-encoded command that retrieves and installs a second-stage package ("swift-parse-stream" or "quirky-token"). This two-step installation obfuscates the true nature of the packages and delays the download of the actual payload until installation time.


    Stage 2: Environment Detection and Evasion


    The second-stage packages—disguised as SVG sanitization utilities—incorporate sophisticated environment detection routines. Before executing the malicious payload, the code performs checks to determine whether it's running in:


  • Cloud development environments (GitHub Codespaces, GitPod, Replit)
  • Containerized sandboxes (Docker)
  • Serverless runtimes (AWS Lambda, Google Cloud Functions)
  • Analysis infrastructure (malware sandboxes, security research labs)

  • This gating mechanism ensures the malware only activates on genuine developer machines, preventing it from detonating in controlled analysis environments where security researchers can study its behavior.


    Stage 3: Payload Delivery and Execution


    Upon clearing environment checks, the packages connect to JSONKeeper (a pastebin-like service) to retrieve additional JavaScript code, which is immediately evaluated using JavaScript's eval() function. The retrieved payload then contacts an external command-and-control server (216.126.236[.]244) to download an encrypted JavaScript loader.


    Once decrypted, this loader enables a comprehensive suite of capabilities:


    ### Remote Access and Control

  • Interactive terminal sessions
  • Arbitrary command execution
  • Screenshot capture
  • Process termination
  • Mouse and keyboard simulation (using the @nut-tree-fork/nut-js library)
  • Window navigation and form interaction

  • ### Data Exfiltration


    The malware systematically collects:


    Developer Credentials and Configurations:

  • Microsoft Visual Studio Code history and settings
  • Windsurf and Cursor editor configurations
  • AWS credentials and profiles
  • Microsoft Azure credentials
  • Google Gemini API keys
  • Anthropic Claude API keys
  • Foundry configurations
  • SSH keys and configurations
  • Z shell (Zsh) history and profiles

  • Browser and Financial Assets:

  • Data from web browsers (cached credentials, cookies, session tokens)
  • Cryptocurrency wallet software and recovery phrases
  • Files matching specific extensions (likely source code, documentation, and configuration)

  • Operational Intelligence:

  • Periodic clipboard monitoring and capture
  • Environment variable enumeration
  • Running process enumeration

  • ## Implications


    The scope and sophistication of this campaign represents a critical escalation in supply chain risk for software development organizations.


    ### Direct Risks


    Developers as Entry Points: Unlike traditional infrastructure security, developer workstations are often the weakest link in security-conscious organizations. A single compromised npm package can grant adversaries access to production credentials, source repositories, and deployment pipelines.


    Credential Harvesting at Scale: The specific targeting of API keys for major cloud providers (AWS, Azure, Google Cloud) and AI platforms (Anthropic Claude, Google Gemini) suggests the threat actors are harvesting credentials for use in subsequent intrusions, lateral movement, or sale on underground markets.


    Persistent Access: The remote access capabilities (terminal sessions, command execution, input simulation) enable attackers to establish long-term persistence on developer machines, potentially remaining undetected for months while harvesting intellectual property.


    ### Systemic Implications


    Supply Chain Fragility: The npm ecosystem contains over 2 million packages, the majority maintained by volunteer developers with minimal security oversight. Each package represents a potential attack surface; a single compromised dependency can propagate across thousands of applications.


    State-Sponsored Targeting: The Lazarus Group's sustained focus on npm indicates that state-sponsored actors view software supply chain compromise as a high-value operation worthy of sustained investment and sophistication. This mirrors the operational patterns seen in nation-state cyberespionage campaigns.


    ## Recommendations


    Organizations and individual developers must implement layered defenses to mitigate npm supply chain risk:


    ### For Developers


  • Lock Dependencies: Use package-lock.json and npm ci (instead of npm install) to prevent automatic updates to new versions, reducing the window for malicious package injection.
  • Verify Package Integrity: Before installing unfamiliar packages, review their GitHub repositories, publication dates, maintainer history, and recent commits.
  • Restrict npm Permissions: Use .npmrc configuration to limit the scope of what npm scripts can access (disable lifecycle scripts for untrusted packages when possible).
  • Isolate Development Environments: Run npm installations and development tooling in containerized or virtualized environments separate from credential storage.
  • Rotate Credentials: Periodically rotate API keys, SSH keys, and cloud provider credentials stored on developer machines.

  • ### For Organizations


  • Supply Chain Inventory: Maintain a comprehensive Software Bill of Materials (SBOM) for all applications, including transitive dependencies.
  • Dependency Scanning: Integrate automated tools (Snyk, npm audit, Dependabot) into CI/CD pipelines to flag known-vulnerable or suspicious packages before deployment.
  • Credential Management: Use centralized secrets management (HashiCorp Vault, AWS Secrets Manager) rather than storing credentials in configuration files or shell profiles.
  • Endpoint Detection: Deploy endpoint detection and response (EDR) solutions on developer workstations to identify suspicious processes, file access, and network connections.
  • Incident Response Planning: Develop procedures for revoking compromised credentials and auditing access logs if a developer machine is suspected of compromise.

  • ---


    ## HackWire Analysis


    The targeting of Anthropic Claude, Google Gemini, and Foundry configurations in this campaign signals a fundamental shift in adversary interest: North Korean threat actors are now actively seeking to compromise AI model access and developer workflows that integrate generative AI.


    This matters because API keys to frontier AI models represent both immediate financial value and longer-term intelligence collection opportunities. An attacker with access to a developer's Claude API key can:

  • Enumerate projects the key holder works on
  • Infer company structure and technical architecture from prompts in API logs
  • Execute arbitrary code generation tasks at the victim's expense
  • Potentially exploit token limits or billing to cause denial of service

  • The pattern here is unmistakable: this is not a generic malware campaign opportunistically harvesting any credentials. The specific focus on dev tool configurations—VS Code, Cursor, Windsurf—combined with targeted collection of AI platform credentials, suggests reconnaissance for deeper supply chain compromise. An attacker who controls a developer's workstation and access to their AI tooling can automate the generation of backdoor-laden code, malicious documentation, or compromised SDK packages, multiplying the attack surface exponentially.


    Critically, the April 2026 campaign published 261 package versions across just 108 unique names. We're not seeing a handful of experimental packages; we're seeing industrialized supply chain attack infrastructure. Each variant likely served to evade emerging detections or target specific victim profiles. The fact that we're now seeing a "fresh wave" (as JFrog describes it) with overlapping tactics suggests the April detections merely disrupted one campaign cycle, not the underlying operation.


    Developers should assume that if they installed any Rollup-adjacent package between March and July 2026, credential auditing is warranted. Organizations should treat this as an escalation point: North Korean state actors have demonstrated they will build and maintain industrial-scale npm attack campaigns. Dependency sprawl is no longer a hygiene issue—it's a nation-state targeting vector.


    HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Tools](https://www.hackwire.news/category/tools) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)