Edizione del 06.07.2026
Malicious npm Rollup Polyfills Linked to Lazarus Target Developer Environments
Researchers identified a malicious npm supply-chain campaign that impersonated Rollup polyfill tooling to compromise developer workstations and CI/build systems. The primary packages,
The final payloads gave attackers remote access and enabled theft of browser data, crypto-wallet information, files, clipboard contents, and other developer secrets such as source code, tokens, SSH keys, and cloud credentials. JFrog said the layered package structure, lookalike naming, and tradecraft resemble earlier Lazarus-linked npm operations, while additional reporting tied the activity to a broader North Korea-linked supply-chain effort referred to as PolinRider. Some malicious packages were replaced with security-holding versions, but others remained available at the time of reporting, prompting guidance to remove the packages, treat affected hosts as compromised, rotate credentials, and block related outbound traffic.
rollup-packages-polyfill-core and rollup-runtime-polyfill-core, mimicked legitimate Rollup-related projects and used staged dependencies including swift-parse-stream, quirky-token, react-icon-svgs, and rollup-plugin-polyfill-connect to trigger a multi-stage infection chain. The malware fetched obfuscated code from JSONKeeper, decrypted additional payloads retrieved from 216.126.236.244, and executed them locally while using evasive checks to avoid some analysis and cloud development environments.The final payloads gave attackers remote access and enabled theft of browser data, crypto-wallet information, files, clipboard contents, and other developer secrets such as source code, tokens, SSH keys, and cloud credentials. JFrog said the layered package structure, lookalike naming, and tradecraft resemble earlier Lazarus-linked npm operations, while additional reporting tied the activity to a broader North Korea-linked supply-chain effort referred to as PolinRider. Some malicious packages were replaced with security-holding versions, but others remained available at the time of reporting, prompting guidance to remove the packages, treat affected hosts as compromised, rotate credentials, and block related outbound traffic.
Microsoft Edge Patches Multiple High-Severity RCE and Security Bypass Flaws
Microsoft Edge (Chromium-based) has received fixes for multiple high-severity vulnerabilities, including remote code execution flaws
Advisories from Microsoft and HKCERT indicate the flaws affect Microsoft Edge and require prompt patching through the browser's latest security updates. While some metadata inconsistently marks the bugs as not remotely exploitable, the listed attack characteristics for several entries include low attack complexity, no privileges required, and in many cases user interaction, making browser update compliance and rapid deployment a priority for enterprise defenders.
CVE-2026-58289, CVE-2026-58293, CVE-2026-58285, CVE-2026-58288, CVE-2026-57974, CVE-2026-58284, CVE-2026-58287, CVE-2026-57981, and CVE-2026-56645, as well as the security feature bypass issue CVE-2026-57983. Public records attribute the issues to Microsoft and rate them from high to critical severity, with CVSS scores reaching 9.0 for CVE-2026-58289 and several others scoring in the 8.1-8.8 range.Advisories from Microsoft and HKCERT indicate the flaws affect Microsoft Edge and require prompt patching through the browser's latest security updates. While some metadata inconsistently marks the bugs as not remotely exploitable, the listed attack characteristics for several entries include low attack complexity, no privileges required, and in many cases user interaction, making browser update compliance and rapid deployment a priority for enterprise defenders.