When Open Source Tooling Becomes a Backdoor: North Korean npm Packages Target Developer Supply Chains

Introduction

Malicious actors linked to North Korea have seeded two fake npm packages that impersonate the Rollup polyfill ecosystem, aiming to poison the software supply chain at its most trusted point—the developer's command line. This campaign, reported by The Hacker News, shows that the attack surface is no longer just the application; it is the toolchain itself.

The problem

According to a report from The Hacker News (thehackernews.com), security researchers at JFrog identified two malicious npm packages—"rollup-packages-polyfill-core" and "rollup-runtime-polyfill-core"—that are associated with threat actors tied to North Korea. These packages were designed to closely mimic the legitimate "rollup-plugin-polyfill-node" project, borrowing its description, repository metadata, and structure to deceive developers. Once installed, they facilitate remote access and data theft, targeting the secrets and credentials that developers routinely handle.

Consequences

When a developer installs a booby-trapped package, the attacker gains a foothold inside the developer's local environment, which often contains SSH keys, API tokens, cloud provider credentials, and access to internal source repositories. A single compromised developer workstation can cascade into a full-scale supply chain attack, allowing the adversary to inject malicious code into legitimate software that is then distributed downstream to end users. The reputational and financial damage to an organization that ships a tainted product can be catastrophic.

Causes