Colleagues, npm packages under Rollup are disguising themselves as polyfills and stealing developers’ secrets

Colleagues, a cybersecurity issue is worth flagging: malicious npm packages have been found posing as Rollup polyfills.

A few red flags stood out:
- the packages mimic the name, description, and metadata of a legitimate project;
- they contain a second-stage payload and execute hidden code during installation;
- the malware checks its environment and tries not to run in sandboxes, CI, or cloud dev environments;
- the result is theft of tokens, SSH keys, cloud credentials, browser data, and wallets, plus remote access.

Why this matters: these dependencies often reach workstations and build pipelines, where the most valuable secrets live.

Are you reviewing dependencies and adding supply-chain checks to CI/CD?