Loading story…
Researchers identified a malicious npm supply-chain campaign that impersonated Rollup polyfill tooling to compromise developer workstations and CI/build systems. The primary packages, rollup-packages-polyfill-core and rollup-runtime-polyfill-core, mimicked legitimate Rollup-related projects and used staged dependencies including swift-parse-stream, quirky-token, react-icon-svgs, and rollup-plugin-polyfill-connect to trigger a multi-stage infection chain. The malware fetched obfuscated code from JSONKeeper, decrypted additional payloads retrieved from 216.126.236.244, and executed them locally while using evasive checks to avoid some analysis and cloud development environments.
The final payloads gave attackers remote access and enabled theft of browser data, crypto-wallet information, files, clipboard contents, and other developer secrets such as source code, tokens, SSH keys, and cloud credentials. JFrog said the layered package structure, lookalike naming, and tradecraft resemble earlier Lazarus-linked npm operations, while additional reporting tied the activity to a broader North Korea-linked supply-chain effort referred to as PolinRider. Some malicious packages were replaced with security-holding versions, but others remained available at the time of reporting, prompting guidance to remove the packages, treat affected hosts as compromised, rotate credentials, and block related outbound traffic.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
A Bluesky post shared a Socket article about the PolinRider supply-chain campaign and described it as North Korea-linked. The post said the operation was expanding across open source ecosystems and associated it with OmniStealer and PolinRider.
At the time of JFrog's analysis, two of the malicious npm packages had been replaced with security-holding versions on npm, while four malicious packages remained available. This reflected a partial response to the campaign but not full removal of the threat.
JFrog identified a cluster of malicious npm packages, including rollup-packages-polyfill-core and rollup-runtime-polyfill-core, masquerading as Rollup polyfill tooling. The packages used a multi-stage infection chain to fetch obfuscated code and deploy payloads for remote access, data theft, filesystem collection, and clipboard monitoring.
Kudelski Security published research on a DPRK-linked 'Contagious Interview' campaign in which operators posing as recruiters tricked developers into running malicious code during fake technical interviews. The report documented a trojanized GitHub repository named Ajuna-solution, C2 infrastructure at 138.201.128.169:1224, remote command execution via eval(), and detection guidance including Suricata and YARA logic.
Checkmarx reported that at least eight malicious PyPI packages tied to Operation Navy Ghost were uploaded between November 2025 and June 2026. The packages masqueraded as legitimate Pyrogram forks and shared identical backdoor logic and operator identifiers.
A supply-chain campaign dubbed Operation Navy Ghost began targeting Python developers building Telegram bots by publishing trojanized Pyrogram forks on PyPI. The malicious packages were active since November 2025 and contained a hidden backdoor that enabled arbitrary code execution, file access, and data exfiltration via Telegram.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 223 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
6 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcebsky.app
Open sourcebleepingcomputer.com
Open sourceresearch.jfrog.com
Open sourcekudelskisecurity.com
Open sourceabout.gitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a broad software supply chain campaign targeting developers and cryptocurrency users through hijacked packages, browser extensions, and compromised maintainer accounts across ecosystems including **npm**, **Go**, **Chrome**, and **Packagist**. Socket linked the activity to North Korean actors associated with the **Contagious Interview** operation and identified 108 malicious packages and extensions spanning 162 release artifacts, while JFrog separately analyzed hijacked npm packages `html-to-gutenberg` `4.2.11` and `fetch-page-assets` `1.2.9` that were uploaded with malicious code. The activity appears to rely on account hijacking rather than compromise of GitHub itself, and some attacker infrastructure reportedly remains active even after certain packages were removed. The malware chain used unusual delivery and evasion techniques aimed at developer workstations, including a **VS Code folder-open task** instead of standard npm lifecycle scripts, JavaScript hidden in a fake font file, and encrypted payload retrieval from blockchain transaction data on **TRON**, **Aptos**, and **BNB Smart Chain**. Researchers said the campaign deployed components including **BeaverTail**, **DEV#POPPER RAT**, **OmniStealer**, a `socket.io` backdoor, and a Python infostealer to steal browser credentials, password-manager contents, cryptocurrency wallet data, developer secrets, and operating system credential-store material across **Windows**, **macOS**, and **Linux**. Security firms warned that affected developer systems and credentials should be treated as fully compromised.
Aug 3, 2026
Two prerelease packages in the legitimate `@joyfill` npm namespace — `@joyfill/layouts@0.1.2-2773.beta.0` and `@joyfill/components@4.0.0-rc24-2773-beta.4` — were published with malicious code embedded in their distribution bundles, causing the payload to run when the package was imported rather than during installation. Researchers said the implant exposed Node.js `require` and `module` globally, resolved command-and-control infrastructure through transactions on **Tron**, **Aptos**, and **BNB Smart Chain**, and then fetched additional payloads including a Node.js remote-access trojan that opened a Socket.IO channel and a downloader contacting `23[.]27[.]13[.]43/$/boot` with the header `Sec-V: A9-0135-3`. Analysis linked the recovered malware to the **PolinRider** loader family and **DEV#POPPER**, while downstream activity also showed a Python credential stealer assessed as a likely **OmniStealer** variant targeting developer workstations. The compromise affects development environments, CI runners, test tooling, server-side rendering, and build systems that import the packages, and protections such as `npm install --ignore-scripts` do not prevent execution because the malicious logic was bundled before publication. Investigators said earlier versions, including `@joyfill/layouts@0.1.1` and `@joyfill/components@4.0.0-rc24`, appeared clean, and advised organizations to treat any environment using the `2773` prerelease versions as compromised, remove them, rebuild from trusted lockfiles, inspect for persistence, and rotate exposed credentials.
Jul 29, 2026
Threat actors are using **malicious npm packages** to steal developer credentials and CI/CD secrets, enabling rapid escalation into cloud environments. Google reported that **UNC6426** leveraged keys stolen during the earlier compromise of the *nx* npm ecosystem to pivot from a stolen developer GitHub token into **AWS administrative access within 72 hours**, abusing **GitHub-to-AWS OpenID Connect (OIDC) trust** to create a new admin role. The actor then used that access to **exfiltrate data from AWS S3** and conduct **destructive actions** in production cloud environments; the initial *nx* compromise involved a GitHub Actions `pull_request_target` workflow abuse (“**Pwn Request**”) that enabled publishing trojanized packages containing a `postinstall` chain that executed the **QUIETVAULT** JavaScript credential stealer and uploaded stolen data to a public GitHub repo (`/s1ngularity-repository-1`). Separately, researchers reported new waves of the **PhantomRaven** npm supply-chain campaign distributing **88 additional malicious packages** (via ~50 disposable accounts) that target JavaScript developers by exfiltrating secrets from files like `.gitconfig` and `.npmrc`, environment variables, and CI/CD tokens (e.g., GitHub/GitLab/Jenkins/CircleCI). The campaign uses **slopsquatting** (LLM-suggested lookalike package names) and a stealth technique called **Remote Dynamic Dependencies (RDD)**, where `package.json` pulls a dependency from an external URL so the malicious payload is fetched at install time (`npm install`) and can evade static package inspection; researchers indicated many of these packages remained available in the npm registry at the time of reporting.
Jun 29, 2026