Threats · 73 days ago
The trap is not the fake package name. It is the install-time code and second-stage dependency chain, which lets the payload run before a quick review of the top-level package or registry cleanup ever sees it. That gives attackers a window to take developer secrets during normal npm installs.
JFrog tied six removed npm packages to a North Korea-linked campaign. The lookalike packages mimicked Rollup polyfill tooling, then pulled in staged packages that fetched and executed the real malware from a remote JSON service, with checks to avoid sandboxes and cloud dev environments.
For teams that install third-party npm packages in CI or on developer workstations, the risk is credential theft from a package tree that looks harmless until the install finishes. Rotating secrets matters because the dangerous part can already have run.
1 source covering this story
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.
Part of the PlainSec briefing for 2026-07-04