npm install of Lazarus rollup-polyfill lookalike packages

Ethan Andrews@eandrews

•updated Jul 2, 2026•1•0•4

Detects the installation of known malicious npm packages designed to impersonate the legitimate 'rollup-plugin-polyfill-node' dependency. This pattern is associated with Lazarus Group supply chain attacks targeting developer environments and CI/CD pipelines.