Lazarus Hides a RAT in npm: Six Fake Rollup Polyfill Packages
The North Korean group is going after developers again. In late June, six malicious npm packages posing as a popular build tool turned up in the registry, each carrying a full remote access trojan.
Between June 30 and July 4, 2026, researchers exposed a chain of six malicious npm packages that posed as polyfill plugins for the Rollup bundler. The packages were rollup-packages-polyfill-core, rollup-runtime-polyfill-core, rollup-plugin-polyfill-connect, swift-parse-stream, quirky-token and react-icon-svgs. The first two mimicked the legitimate rollup-plugin-polyfill-node, which pulls around 295,000 downloads a week. Analysts at JFrog and other teams link the campaign to Lazarus. All six packages have since been removed from the registry.
How the attack works
The clever part is that the malware fires on import, not on install. Most scanners watch install scripts, but here the backdoor hides in the CommonJS file dist/index.js and runs the moment code calls require(). From there it quietly pulls in second-stage packages, executes code hosted on the JSONKeeper service, and decrypts a follow-on payload from the command server at 216.126.236.244.
The result is that a developer's workstation or a CI runner becomes a remote-access foothold, complete with browser data theft and clipboard monitoring. That puts more than one person at risk: it exposes the whole build pipeline, and the infection can travel further downstream through it.
An old playbook, a familiar target
Going after developers through open-source repositories is nothing new for Lazarus. For years the group has handed out malware disguised as coding assignments in job interviews (the "contagious interview" technique), as packages on npm and PyPI, and as fake GitHub projects promoted on LinkedIn and Discord. Malware families such as BeaverTail and OtterCookie keep showing up. The logic is simple: developers, and the crypto wallets they can reach, are the shortest path to money.
Not just code: the scale of 2026
The July case is one episode among many. In April 2026, Lazarus was blamed for the theft of around 290 million dollars from the KelpDAO project, after poisoning infrastructure tied to LayerZero and draining rsETH tokens. Separately, the group has broadened into extortion: since late 2025 it has been linked to Medusa ransomware attacks on healthcare and non-profit organizations in the US, increasingly working as an affiliate of ready-made RaaS operations rather than building its own tools. By most estimates, Lazarus stole more than 5 billion dollars in cryptocurrency between 2021 and 2025.
Who they are
Lazarus is an umbrella name for North Korea's state hackers. The US Treasury formally ties the group to the North Korean government, and Western agencies assess that the stolen funds go toward financing the regime, including its weapons programs. That explains the range: espionage, cryptocurrency theft, supply-chain attacks and now extortion all sit in the same portfolio.
For developers the takeaway is concrete: a package with a plausible name and thousands of downloads next door is no guarantee of safety. It is worth checking what runs not on install, but on the first import.
Based on research by JFrog and Symantec, and reporting by The Hacker News and Infosecurity Magazine.
Written by
Read next
$643M in Six Months: How Lazarus Operates and Where the Evidence Runs Out
In the first half of 2026, analysts at TRM Labs attributed roughly $643 million to groups linked to North Korea, about 66% of everything stolen from the cryptocurrency industry, out of some $972 million lost across 207 incidents. Almost all of it came from two April attacks on DeFi protocols: the roughly $292 million breach of KelpDAO and the $285 million hit on Drift Protocol. A year earlier the shape was similar but the scale was not. Chainalysis put 2024 losses to DPRK-linked hackers at $1.34
Silver Fox Levels Up: The Chinese Crew Switches to Rust
Known for its fake installers, the China-linked group Silver Fox has a new tool, MODBEACON. Judging by the engineering, the fox is done playing the amateur.
A $10 Million Price Tag: Meet Wazawaka, One of the FBI's Most Wanted
Mikhail Matveev is accused of ransomware attacks around the world, and the US will pay up to 10 million dollars for information on him. He lives openly in Russia, taunts the FBI, and has now been charged by the Kremlin too.
$643M in Six Months: How Lazarus Operates and Where the Evidence Runs Out
In the first half of 2026, analysts at TRM Labs attributed roughly $643 million to groups linked to North Korea, about 66% of everything stolen from the cryptocurrency industry, out of some $972 million lost across 207 incidents. Almost all of it came from two April attacks on DeFi protocols: the roughly $292 million breach of KelpDAO and the $285 million hit on Drift Protocol. A year earlier the shape was similar but the scale was not. Chainalysis put 2024 losses to DPRK-linked hackers at $1.34
Microsoft Patches a Record 570 Flaws, Two Zero-Days Already Under Attack
On Tuesday, July 14, Microsoft shipped the largest set of fixes in Patch Tuesday history, closing 570 vulnerabilities at once. Attackers are already exploiting two of them in the wild, and a third was publicly disclosed before the patch landed. The most serious of the exploited bugs is CVE-2026-56164 in Microsoft SharePoint Server. A missing authentication check in a critical function lets an unauthenticated attacker escalate privileges across the network, with no password at all. Researchers a
LegacyHive: Unpatched Windows Zero-Day PoC Dropped Hours After Patch Tuesday
Within hours of July's Patch Tuesday, a researcher going by Nightmare Eclipse (also seen as Chaotic Eclipse) published a proof-of-concept exploit for a new Windows vulnerability dubbed LegacyHive. No patch existed at the time of release, and the exploit works on the latest build of the system, assembled with July's updates already applied. The vulnerability lives in the Windows User Profile Service (ProfSvc) and its registry hive loading mechanism. When a user signs in, Windows mounts the UsrCl