JavaScript build ecosystem / Developers"

Date (as written): 2026-06-30
Year: 2026
Country: Global
Actors (as written): Lazarus Group
Actor pages: Lazarus Group
Tags (as written): Attack: Malware; Attack Class: Cyber Crime,Cyber Espionage

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

JavaScript build ecosystem / Developers" · 2026-06-30

JFrog Security research team identifies a malicious npm package cluster masquerading as Rollup polyfill tooling, leading to multi-stage JavaScript payloads with credential-theft and remote-access components. [Date Occurred: Unspecified; Date Discovered: Unspecified]

https://www.hackmageddon.com/2026/07/07/16-30-june-2026-cyber-attacks-timeline/

https://thehackernews.com/2026/07/north-korea-linked-npm-packages-mimic.html

JFrog Security Research

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills · 2026-06-30

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills ... This layered structure, together with the lookalike names, legitimate-looking metadata, hidden install-time execution, environment checks, and credential-theft/remote-access payloads, is similar to previous North Korean Lazarus-linked npm campaigns.

https://research.jfrog.com/post/rollup-polyfill-masquerading/

Suggest a correction on GitHub