North Korea-Linked npm Supply Chain Attack: Rollup Polyfill Mimicry Detection

Introduction

A sophisticated supply chain attack has been identified targeting the JavaScript ecosystem, specifically developers utilizing the Rollup build tool. Threat actors linked to North Korea have published malicious packages to the npm registry—rollup-packages-polyfill-core and rollup-runtime-polyfill-core—designed to masquerade as legitimate polyfill tooling.

This campaign is not merely a nuisance; it is an active intelligence-gathering operation. Upon installation, these packages facilitate the theft of sensitive developer credentials (API keys, tokens) and establish remote access mechanisms. For organizations with active development pipelines, the immediate risk is credential compromise and potential lateral movement into source code repositories. Defensive action is required immediately to audit environments and eject these dependencies.

Technical Analysis

Affected Platforms: Node.js environments (Windows, Linux, macOS) utilizing the npm package manager.

Threat Vector: Dependency Confusion / Typosquatting. The attackers meticulously copied metadata from the legitimate rollup-plugin-polyfill-node project, including descriptions and repository URLs, to trick developers and automated scanners.

Malicious Packages:

rollup-packages-polyfill-core
rollup-runtime-polyfill-core

Attack Chain:

Initial Compromise: A developer or CI/CD pipeline runs npm install targeting one of the malicious packages.
Execution: The package's postinstall script triggers. This script is typically obfuscated JavaScript.
Payload Delivery: The script decodes and executes a shell command or Node.js script.
Exfiltration & C2: The malware scours the filesystem for configuration files (e.g., .npmrc, .env, .aws/credentials) and exfiltrates them to a Command & Control (C2) server. It may also establish a reverse shell for persistent access.

Exploitation Status: Confirmed active exploitation. JFrog researchers have verified the malicious nature of the packages and their capability for data theft.

Detection & Response

To detect this threat, security teams must monitor package installation events and scan for the presence of these specific artifacts in node_modules directories. The following rules and queries are designed to identify the installation or presence of these malicious packages.

SIGMA Rules

YAML

---
title: Potential Installation of Malicious Rollup NPM Packages
id: 8a4b2c1d-9e3f-4a5b-8c6d-1e2f3a4b5c6d
status: experimental
description: Detects the installation of identified malicious npm packages mimicking Rollup polyfills.
references:
  - https://thehackernews.com/2026/07/north-korea-linked-npm-packages-mimic.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.supply_chain
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\npm.cmd'
      - '\npm.exe'
    CommandLine|contains:
      - 'rollup-packages-polyfill-core'
      - 'rollup-runtime-polyfill-core'
  condition: selection
falsepositives:
  - Legitimate installation of a package with a similar name (verify package hash)
level: critical
---
title: Linux NPM Installation of Malicious Rollup Packages
id: 9b5c3d2e-0f4a-5b6c-9d7e-2f3a4b5c6d7e
status: experimental
description: Detects the installation of identified malicious npm packages on Linux systems.
references:
  - https://thehackernews.com/2026/07/north-korea-linked-npm-packages-mimic.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.supply_chain
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/npm'
    CommandLine|contains:
      - 'rollup-packages-polyfill-core'
      - 'rollup-runtime-polyfill-core'
  condition: selection
falsepositives:
  - Legitimate installation of a package with a similar name (verify package hash)
level: critical

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt for npm process creation events involving the malicious package names
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoOriginalFileName in~ ("npm.exe", "npm") or FolderPath endswith @"\node.exe" 
| where ProcessCommandLine has_any ("rollup-packages-polyfill-core", "rollup-runtime-polyfill-core")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend IoC = case(ProcessCommandLine has "rollup-packages-polyfill-core", "rollup-packages-polyfill-core", 
                      ProcessCommandLine has "rollup-runtime-polyfill-core", "rollup-runtime-polyfill-core", "Unknown")

Velociraptor VQL

VQL — Velociraptor

-- Hunt for the presence of malicious directories in node_modules
SELECT FullPath, Size, Mtime
FROM glob(globs="/*/node_modules/rollup-packages-polyfill-core/**")
WHERE Size > 0

-- Check for the second malicious package
SELECT FullPath, Size, Mtime
FROM glob(globs="/*/node_modules/rollup-runtime-polyfill-core/**")
WHERE Size > 0

Remediation Script (Bash)

Bash / Shell

#!/bin/bash

# Remediation script for malicious npm packages
# Usage: ./remediate_rollup.sh [path_to_project_root]
# If no path is provided, it scans the current directory.

TARGET_DIR=${1:-.}

echo "[+] Scanning for malicious Rollup packages in $TARGET_DIR..."

# Find and remove node_modules directories containing the malicious packages
find "$TARGET_DIR" -type d -name "node_modules" -prune -exec sh -c '
  if [ -d "{}/rollup-packages-polyfill-core" ] || [ -d "{}/rollup-runtime-polyfill-core" ]; then
    echo "[!] MALICIOUS PACKAGE DETECTED in: {}"
    echo "[*] Removing node_modules directory at: {}"
    rm -rf {}
  fi
' sh {} \;

# Audit package-lock. or yarn.lock for the package name
echo "[+] Checking lock files for malicious dependencies..."
find "$TARGET_DIR" -type f \( -name "package-lock." -o -name "yarn.lock" \) -exec sh -c '
  if grep -q "rollup-packages-polyfill-core\|rollup-runtime-polyfill-core" "$1"; then
    echo "[!] MALICIOUS DEPENDENCY FOUND IN LOCK FILE: $1"
    echo "[*] Manual removal of dependency entry required from package.."
  fi
' sh {} \;

echo "[+] Scan complete. Please rotate any developer credentials stored in the environment if compromise is suspected."

Remediation

Immediate Removal: Uninstall the malicious packages immediately by running: bash

Bash / Shell

    npm uninstall rollup-packages-polyfill-core rollup-runtime-polyfill-core

Code

Alternatively, delete the entire `node_modules` folder and `package-lock.` file, then reinstall dependencies from a trusted `package.` (after verifying no malicious entries exist there).

2. Audit Dependencies: Review all package. files in your environment to ensure these packages are not listed as dependencies. Verify that internal package registries have not cached these versions.

Credential Rotation: Assume that any credentials (AWS keys, database strings, API tokens) present in the environment where these packages were installed are compromised. Rotate these secrets immediately.
Vendor Advisory: Refer to the official JFrog security advisory for the latest Indicators of Compromise (IOCs) and specific package hashes to block.
Supply Chain Hardening: Enable npm audit features in CI/CD pipelines (npm audit) and implement Software Bill of Materials (SBOM) generation to detect anomalies in dependency trees automatically.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub