North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets

North Korean hackers have been identified behind a new wave of deceptive npm packages that pretend to be legitimate Rollup polyfill tools to steal sensitive developer data and credentials. These packages closely mimic the real "rollup-plugin-polyfill-node," complete with accurate metadata and descriptions, tricking developers into installing them unknowingly. This incident highlights a significant security risk for developers using npm, emphasizing the need for heightened vigilance when installing packages from unverified sources. The implications are serious, as this could lead to unauthorized access and data breaches, underscoring the global cyber threat landscape.