Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

A malicious npm package cluster linked to the North Korean threat actor Lazarus has been identified masquerading as legitimate Rollup polyfill tools. By imitating the naming, metadata, and README of the widely used `rollup-plugin-polyfill-node` package, the attackers targeted developers and CI/CD pipelines. The infection chain uses a sophisticated multi-stage approach, leveraging JSONKeeper for payload delivery and environment checks to evade analysis infrastructure before deploying final-stage malware.

The final stages include `scdata` for remote access and `ldata` for targeted data theft. The malware is designed to exfiltrate sensitive developer assets, including AWS/cloud credentials, SSH keys, browser profile data, and cryptocurrency wallet information. The inclusion of interactive terminal capabilities, screenshot capture, and clipboard monitoring suggests a high-impact threat capable of both persistent espionage and immediate financial theft.