{"id":"MAL-2026-12428","summary":"Malicious code in rollup-packages-node-polyfills (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dd41e8f4e3846a790a96f518bbdcfe70be2839531c5ea5485924e7fd25603399)\nThe package is a typosquat of `rollup-plugin-polyfill-node`. On `require()` of the main entry (`dist/index.js`), a base64-encoded command `npm install cors-update --no-save --silent --no-audit --no-fund` is decoded and passed to `child_process.spawn` with `stdio:'ignore'` and `windowsHide:true`. When the install child exits, the code then base64-decodes the module name `cors-update`, dynamically `require`s it, and invokes `.getPlugin()()`, executing whatever code that separately-published package ships. The command string and the target module name are both stored as base64 literals to evade plain-text scanners. The package's advertised purpose (a Rollup Node polyfills plugin) does not require installing or executing any other npm package at import time.\n","modified":"2026-08-05T13:35:51.314118923Z","published":"2026-08-05T12:25:23Z","database_specific":{"malicious-packages-origins":[{"versions":["0.13.2"],"id":"IN-MAL-2026-014846","import_time":"2026-08-05T13:08:50.752419587Z","modified_time":"2026-08-05T13:00:44Z","sha256":"69acfb561d96b50bad013aee083ca9334855473d17983665b077953853827a20","source":"amazon-inspector"},{"versions":["0.0.1"],"id":"IN-MAL-2026-014847","import_time":"2026-08-05T13:08:50.818159326Z","modified_time":"2026-08-05T13:00:51Z","sha256":"8271e51ffa2367b6282e7ed6834cf70ba341d4c56051e3cc1d25acdcaeab3e9f","source":"amazon-inspector"},{"import_time":"2026-08-05T13:08:47.249676232Z","modified_time":"2026-08-05T12:52:52Z","sha256":"dd41e8f4e3846a790a96f518bbdcfe70be2839531c5ea5485924e7fd25603399","source":"amazon-inspector","versions":["0.13.1"],"id":"IN-MAL-2026-014798"},{"import_time":"2026-08-05T13:08:33.823108056Z","modified_time":"2026-08-05T12:25:23Z","sha256":"f9f367bb71da1310a9cb108ef4132a9e4455013547561f0de311bd672f5fd230","source":"amazon-inspector","versions":["0.13.0"],"id":"IN-MAL-2026-014649"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/rollup-packages-node-polyfills/v/0.13.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/rollup-packages-node-polyfills/v/0.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/rollup-packages-node-polyfills/v/0.13.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/rollup-packages-node-polyfills/v/0.13.0"}],"affected":[{"package":{"name":"rollup-packages-node-polyfills","ecosystem":"npm","purl":"pkg:npm/rollup-packages-node-polyfills"},"versions":["0.13.2","0.0.1","0.13.1","0.13.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rollup-packages-node-polyfills/MAL-2026-12428.json","indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"aab2343549f633386070530996481751975ee796e0f30b52200410b76b730d6b","tlsh":"4e81642514f629550373b6ec518bec71397b9393338ccb503e2c83709fa15288a76af5"}],"package_integrity":[{"hashes":{"sha1":"4c5c587106a3da76a471981552bc1a01690b8d6f","sha512_sri":"sha512-hfIi7VbhFGD/jlJiC8G4dfw6fxacgKuscdKlCrDX4J/J4L95IFBKBURTcqt0m9Bs1DognX839zpmlECEn1n9sA=="},"filename":"rollup-packages-node-polyfills-0.13.2.tgz"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}