T1195.002: Malicious npm Package Impersonating rollup-plugin-polyfill-node

Tim Peck@timpeck

•updated Jul 2, 2026•0•0•6

Detects the execution of npm install commands that include known malicious package names associated with a supply chain attack linked to the Lazarus Group. These packages are designed to impersonate the legitimate 'rollup-plugin-polyfill-node' package.