Security researchers have uncovered a new campaign involving malicious npm packages designed to steal sensitive information from developers. These packages, attributed to threat actors associated with North Korea, are disguised as legitimate Rollup polyfill tools.
The discovered packages include names such as "rollup-packages-polyfi," "rollup-plugin-polyfill," and "rollup-polyfill." Their primary objective is to establish remote access to compromised systems and exfiltrate valuable data.
Upon installation, these malicious packages execute a script that fetches and runs additional malicious code from a remote server. This secondary payload is responsible for collecting and transmitting sensitive information back to the attackers.
The types of data targeted include developer secrets such as API keys, authentication tokens, and potentially other credentials stored within the development environment. This information could then be used for further malicious activities, including unauthorized access to cloud services, code repositories, or other sensitive systems.
The campaign specifically targets developers using npm, the default package manager for Node.js. By impersonating essential development tools like Rollup polyfills, the attackers aim to trick developers into unknowingly installing the malicious code into their projects.
Rollup is a module bundler for JavaScript, commonly used in modern web development to package code for efficient delivery. Polyfills are used to provide modern functionality in older JavaScript environments that do not natively support it. The malicious packages leverage the trust associated with these development tools to gain a foothold.
While the specific details of the remote server infrastructure and the full extent of the data exfiltration are still under investigation, the discovery highlights a growing trend of supply chain attacks targeting the software development ecosystem. Developers are a prime target due to their access to valuable credentials and intellectual property.
As a general security measure, developers are advised to exercise extreme caution when installing any npm packages, especially those that appear to be related to common tools or utilities. It is recommended to verify the authenticity and reputation of packages before adding them to projects, review package dependencies, and consider using security scanning tools to detect malicious code.
