> ## Content Index
> Fetch the complete content index at: https://www.russianhackers.co/llms.txt
> Use this file to discover other available public pages before exploring further.

# Lazarus Hides a RAT in npm: Six Fake Rollup Polyfill Packages
- URL: https://www.russianhackers.co/lazarus-npm-rollup-polyfill-rat/
- Published: 2026-07-15T15:36:09.000Z
- Updated: 2026-07-15T16:31:20.000Z
- Description: The North Korean group is going after developers again. In late June, six malicious npm packages posing as a popular build tool turned up in the registry, each carrying a full remote access trojan.
- Author: Martin
- Tags: Hackers, Malware

Between June 30 and July 4, 2026, researchers exposed a chain of six malicious npm packages that posed as polyfill plugins for the Rollup bundler. The packages were `rollup-packages-polyfill-core`, `rollup-runtime-polyfill-core`, `rollup-plugin-polyfill-connect`, `swift-parse-stream`, `quirky-token` and `react-icon-svgs`. The first two mimicked the legitimate `rollup-plugin-polyfill-node`, which pulls around 295,000 downloads a week. Analysts at JFrog and other teams link the campaign to Lazarus. All six packages have since been removed from the registry.

## How the attack works

The clever part is that the malware fires on import, not on install. Most scanners watch install scripts, but here the backdoor hides in the CommonJS file `dist/index.js` and runs the moment code calls `require()`. From there it quietly pulls in second-stage packages, executes code hosted on the JSONKeeper service, and decrypts a follow-on payload from the command server at `216.126.236.244`.

The result is that a developer's workstation or a CI runner becomes a remote-access foothold, complete with browser data theft and clipboard monitoring. That puts more than one person at risk: it exposes the whole build pipeline, and the infection can travel further downstream through it.

## An old playbook, a familiar target

Going after developers through open-source repositories is nothing new for Lazarus. For years the group has handed out malware disguised as coding assignments in job interviews (the "contagious interview" technique), as packages on npm and PyPI, and as fake GitHub projects promoted on LinkedIn and Discord. Malware families such as BeaverTail and OtterCookie keep showing up. The logic is simple: developers, and the crypto wallets they can reach, are the shortest path to money.

## Not just code: the scale of 2026

The July case is one episode among many. In April 2026, Lazarus was blamed for the theft of around 290 million dollars from the KelpDAO project, after poisoning infrastructure tied to LayerZero and draining rsETH tokens. Separately, the group has broadened into extortion: since late 2025 it has been linked to [Medusa ransomware](https://www.russianhackers.co/tag/ransomware/) attacks on healthcare and non-profit organizations in the US, increasingly working as an affiliate of ready-made RaaS operations rather than building its own tools. By most estimates, Lazarus stole more than 5 billion dollars in cryptocurrency between 2021 and 2025.

## Who they are

Lazarus is an umbrella name for North Korea's state hackers. The US Treasury formally ties the group to the North Korean government, and Western agencies assess that the stolen funds go toward financing the regime, including its weapons programs. That explains the range: espionage, cryptocurrency theft, supply-chain attacks and now extortion all sit in the same portfolio.

For developers the takeaway is concrete: a package with a plausible name and thousands of downloads next door is no guarantee of safety. It is worth checking what runs not on install, but on the first import.

*Based on research by JFrog and Symantec, and reporting by The Hacker News and Infosecurity Magazine.*