North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets

North Korea-linked threat actors deployed malicious npm packages, specifically rollup-packages-polyfill-core and rollup-runtime-polyfill-core, mimicking the legitimate rollup-plugin-polyfill-node to steal developer secrets and enable remote access. Simultaneously, state-backed hackers from North Korea stole $643M in cryptocurrency during the first half of 2026. These incidents, reported by JFrog and Crypto Briefing, underscore significant security vulnerabilities in DeFi and the broader global financial stability threatened by these sophisticated state-sponsored cybercrime operations.