North Korea npm Packages Steal Secrets

Threat actors linked to North Korea uploaded two new malicious npm packages mimicking legitimate Rollup polyfill tools for developer data theft. The lookalike projects install second-stage utilities that fetch encrypted malware from external servers and execute payloads enabling remote access, screenshot capture, clipboard monitoring, and credential harvesting across cloud environments.