MAL-2026-12428

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rollup-packages-node-polyfills/MAL-2026-12428.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12428
Published
2026-08-05T12:25:23Z
Modified
2026-08-05T13:35:51.314118923Z
Summary
Malicious code in rollup-packages-node-polyfills (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dd41e8f4e3846a790a96f518bbdcfe70be2839531c5ea5485924e7fd25603399)

The package is a typosquat of rollup-plugin-polyfill-node. On require() of the main entry (dist/index.js), a base64-encoded command npm install cors-update --no-save --silent --no-audit --no-fund is decoded and passed to child_process.spawn with stdio:'ignore' and windowsHide:true. When the install child exits, the code then base64-decodes the module name cors-update, dynamically requires it, and invokes .getPlugin()(), executing whatever code that separately-published package ships. The command string and the target module name are both stored as base64 literals to evade plain-text scanners. The package's advertised purpose (a Rollup Node polyfills plugin) does not require installing or executing any other npm package at import time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.13.2"
            ],
            "id": "IN-MAL-2026-014846",
            "import_time": "2026-08-05T13:08:50.752419587Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T13:00:44Z",
            "sha256": "69acfb561d96b50bad013aee083ca9334855473d17983665b077953853827a20"
        },
        {
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014847",
            "import_time": "2026-08-05T13:08:50.818159326Z",
            "versions": [
                "0.0.1"
            ],
            "modified_time": "2026-08-05T13:00:51Z",
            "sha256": "8271e51ffa2367b6282e7ed6834cf70ba341d4c56051e3cc1d25acdcaeab3e9f"
        },
        {
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014798",
            "import_time": "2026-08-05T13:08:47.249676232Z",
            "versions": [
                "0.13.1"
            ],
            "sha256": "dd41e8f4e3846a790a96f518bbdcfe70be2839531c5ea5485924e7fd25603399",
            "modified_time": "2026-08-05T12:52:52Z"
        },
        {
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014649",
            "import_time": "2026-08-05T13:08:33.823108056Z",
            "versions": [
                "0.13.0"
            ],
            "modified_time": "2026-08-05T12:25:23Z",
            "sha256": "f9f367bb71da1310a9cb108ef4132a9e4455013547561f0de311bd672f5fd230"
        }
    ]
}
References
Credits

Affected packages

npm / rollup-packages-node-polyfills

Package

Name
rollup-packages-node-polyfills
View open source insights on deps.dev
Purl
pkg:npm/rollup-packages-node-polyfills

Affected ranges

Affected versions

0.*
0.0.1
0.13.0
0.13.1
0.13.2

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rollup-packages-node-polyfills/MAL-2026-12428.json"
indicators 
{
    "evidence_files": [
        {
            "tlsh": "4e81642514f629550373b6ec518bec71397b9393338ccb503e2c83709fa15288a76af5",
            "sha256": "aab2343549f633386070530996481751975ee796e0f30b52200410b76b730d6b",
            "path": "dist/index.js"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "4c5c587106a3da76a471981552bc1a01690b8d6f",
                "sha512_sri": "sha512-hfIi7VbhFGD/jlJiC8G4dfw6fxacgKuscdKlCrDX4J/J4L95IFBKBURTcqt0m9Bs1DognX839zpmlECEn1n9sA=="
            },
            "filename": "rollup-packages-node-polyfills-0.13.2.tgz"
        }
    ]
}