threat-intel
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
High
Summary
North Korean-linked threat actors are deploying malicious npm packages that mimic Rollup polyfill tooling to steal developer secrets. These packages, including 'rollup-packages-polyfill-core' and 'rollup-runtime-polyfill-core', utilize a layered approach involving SVG utilities and JSONKeeper to execute JavaScript payloads. The malware capabilities extend beyond simple data theft, offering remote access control, screenshot capture, and the ability to steal credentials from various sources, mirroring tactics used in previous Lazarus campaigns.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data