Notifications
Clear all
Topic starter
19/08/2026 3:53 pm
TL;DR: Malicious npm packages impersonating Rollup polyfill tooling shifted execution from install time to CommonJS plugin import time, then chained remote payload retrieval, secret collection, and RAT-style host control across developer workstations and CI runners, according to Corgea. This breaks the assumption that blocking lifecycle scripts is enough; build-path imports now need the same scrutiny as package installs.
NHIMG editorial — based on content published by Corgea: analysis of malicious Rollup-themed npm packages and their import-time execution chain
By the numbers:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and they are 13% more likely to be categorised as critical than code-based leaks.
Questions worth separating out
Q: What breaks when malicious npm packages execute on import instead of install?
A: Install-time controls often miss import-time payloads because the malicious code lives in the published bundle and runs when the module loads.
Q: What breaks when supply-chain poisoning reaches developer workstations and CI runners?
A: The main failure is assuming a compromised package only affects one project.
Q: How do security teams know whether a dependency compromise reached production?
A: They need to combine SBOM review, lockfile inspection, CI build logs, endpoint telemetry, and outbound network monitoring.
Practitioner guidance
- Restrict build-time import paths Inventory Rollup, Vite, and shared config files for plugin imports that execute during bootstrap, then block unknown or newly added packages from loading in trusted build paths.
- Scope secrets out of runner workspaces Remove cloud keys, SSH material, browser profiles, and AI-assistant directories from developer and CI environments unless the job explicitly needs them, and mount them only for the shortest possible runtime.
- Monitor outbound network calls from build processes Alert on package installs, JSON fetches, and unexpected process spawning from Node-based build jobs, especially requests to unfamiliar domains or direct IP addresses.
What's in the full analysis
Corgea's full analysis covers the operational detail this post intentionally leaves for the source:
- Package-level indicators and registry-state clues that help separate benign history from malicious release activity
- The full import-path and payload chain, including the remote JSON loader and encrypted follow-on stage
- Host-level hunting guidance for browser profiles, shell history, cloud keys, and AI-assistant directories
- Detection examples for identifying whether a developer or runner actually executed the malicious plugin
👉 Read Corgea's analysis of Rollup plugin malware and import-time execution →
Rollup polyfill malware: what build-tool imports now mean for security?
Explore further
19/08/2026 4:30 pm
Build-tool imports are becoming a new credential execution boundary: This incident shows that package-install hardening is necessary but incomplete. The meaningful risk now sits in runtime dependency resolution, where trusted config files can execute attacker code long after the install step has passed. Practitioners should treat plugin loading as an identity event, not just a software event.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to The State of Secrets Sprawl 2026.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, so discovery without revocation leaves a live attack surface.
A question worth separating out:
Q: Who is accountable when a build process loads malicious code and exposes credentials?
A: Accountability usually spans engineering, platform, and security teams because the failure sits at the intersection of dependency governance, secret placement, and host hardening. NIST-style access and audit controls apply to the systems that allowed the process to run with excessive trust.
👉 Read our full editorial: Rollup plugin imports can trigger npm malware beyond install-time checks
