North Korea-Linked npm Packages Steal Developer Data

Threat actors with connections to North Korea have discovered a new series of malicious npm packages that disguise themselves as Rollup polyfill tools. These packages, named rollup-packages-polyfill-core and rollup-runtime-polyfill-core, are designed to enable remote access and steal data. According to an analysis by JFrog, these packages mimic the legitimate project rollup-plugin-polyfill-node, including the description and repository metadata. The malicious packages were published in the npm registry and are intended to deceive unsuspecting developers. The deception occurs through the use of similar names and descriptions, making it difficult to distinguish harmful packages from legitimate ones.

Developers who install these packages risk compromising their sensitive data. JFrog has identified the vulnerability and is warning the developer community about the dangers posed by these packages. The analysis shows that the packages not only function as polyfills but also serve as backdoors, allowing attackers to access developers' systems. This could lead to significant loss of confidential information. JFrog's security researchers promptly removed the packages from the npm registry after recognizing the threat.

Nevertheless, the danger remains that developers may have already installed these packages before they were removed. Researchers recommend reviewing all installed packages and uninstalling any suspicious ones. The connection to North Korea is not new, as the country has repeatedly been linked to cyberattacks and data theft in the past. These new activities demonstrate that the threat from North Korean hackers continues to exist and evolve. The use of malicious npm packages is a common tactic to infiltrate developers and steal data.

Developers are urged to review their security practices and ensure that they only use trusted packages. Utilizing tools to verify the integrity of npm packages can help detect such threats before they cause harm. JFrog has also recommended regularly performing security updates and following the latest security guidelines. The incidents highlight the need for increased vigilance within the developer community. Given the rising number of cyberattacks, it is crucial for developers to be aware of the risks and take proactive measures to protect their systems.

The security landscape is further complicated by the constant evolution of new threats. The vulnerability exploited by these packages could potentially affect thousands of developers who rely on npm. According to JFrog, the packages are capable of stealing sensitive information such as API keys and credentials. Developers should therefore exercise particular caution and regularly review their dependencies. The incidents have also drawn the attention of security authorities, who continue to monitor the activities of North Korean hackers.

The threat of cybercrime remains a central concern for businesses and developers worldwide. Security authorities advise reporting suspicious activities immediately and taking appropriate action. The vulnerability was publicly disclosed by JFrog on July 5, 2026, and researchers are continuing to assess the impact of the malicious packages.