MAL-2026-12429

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rollup-plugins-check/MAL-2026-12429.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12429
Published
2026-08-05T13:03:49Z
Modified
2026-08-05T13:35:52.284760872Z
Summary
Malicious code in rollup-plugins-check (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5f2c7fe6586c3734730d6f8cd5ffe893c3f7cc5ff82710d1f4df22b8e76987e8)

The npm package rollup-plugins-check@0.0.2 declares a postinstall script (node dist/module.js) that, on npm install, performs an HTTPS GET to https://workconfig.vercel.app with rejectUnauthorized: false and passes the response body to new Function('require', data)(require), executing the fetched code inside the installer's Node.js process with access to require. The remote body is opaque and controlled by whoever owns the endpoint; TLS certificate verification is explicitly disabled, so any on-path attacker can also substitute the payload. The package advertises itself as a rollup polyfill plugin and ships polyfill code copied from rollup-plugin-polyfill-node as cover, while the dropper is appended to the postinstall entry file. The name resembles the legitimate rollup-plugin-polyfill-node package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T13:04:05Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014869",
            "import_time": "2026-08-05T13:08:52.077601125Z",
            "sha256": "2df0babe61716192dc900fc371f95e6b68d67568d680aa54b322a59688fbebeb",
            "versions": [
                "0.0.1"
            ]
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T13:03:49Z",
            "sha256": "5f2c7fe6586c3734730d6f8cd5ffe893c3f7cc5ff82710d1f4df22b8e76987e8",
            "import_time": "2026-08-05T13:08:51.974792452Z",
            "id": "IN-MAL-2026-014867",
            "versions": [
                "0.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / rollup-plugins-check

Package

Name
rollup-plugins-check
View open source insights on deps.dev
Purl
pkg:npm/rollup-plugins-check

Affected ranges

Affected versions

0.*
0.0.1
0.0.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "rollup-plugins-check-0.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-iWwIS5HJv4AAIJ1eCHyS1eNM0lzFFPq7TR7dW73Chk3gWVvShr6wcJNWyLO4DqMsguY6YlVEAcTVOWe9/+i/fw==",
                "sha1": "3f69accd5b1fefce957ae3445a30caf2a23a9127"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "0451f67507788bd437a094ea8f51b45ede934ec31212f2e2bc65c158ef38c18b4d9ab8",
            "sha256": "b4d6eeb1433696e73d839509c8b8ad9d747fb48fc68200d98c09400e332dd251",
            "path": "dist/module.js"
        },
        {
            "tlsh": "8b318f30cd5d4ea31ad825fd9876a19390348ad309c5f84833a6421c4f4f67f10bea6e",
            "sha256": "ef489709ea8b27a3470429bb3981fb06cca900a5210efa0aca2bfb3a95011814",
            "path": "package.json"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rollup-plugins-check/MAL-2026-12429.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]