JFrog identified a Lazarus-linked npm supply-chain campaign that hid malicious code in Rollup-themed lookalike packages and SVG utility second stages. The packages fetched a JSONKeeper payload, decrypted a remote stage from 216.126.236.244, and launched Node.js components for remote access, browser and crypto-wallet data theft, broad file collection, and clipboard monitoring. The targeting of developer workstations and CI/build environments created risk to npm, GitHub, cloud, SSH, package-registry, browser-stored, and wallet credentials.