rollup-plugins-check @0.0.2

Summary

The npm package rollup-plugins-check@0.0.2 declares a postinstall script ( node dist/module.js ) that, on npm install , performs an HTTPS GET to https://workconfig.vercel.app with rejectUnauthorized: false and passes the response body to new Function('require', data)(require) , executing the fetched code inside the installer's Node.js process with access to require . The remote body is opaque and controlled by whoever owns the endpoint; TLS certificate verification is explicitly disabled, so any on-path attacker can also substitute the payload. The package advertises itself as a rollup polyfill plugin and ships polyfill code copied from rollup-plugin-polyfill-node as cover, while the dropper is appended to the postinstall entry file. The name resembles the legitimate rollup-plugin-polyfill-node package.

Source: amazon-inspector (5f2c7fe6586c3734730d6f8cd5ffe893c3f7cc5ff82710d1f4df22b8e76987e8)