rollup-packages-polyfill-core is a malicious npm package designed to impersonate the legitimate rollup-plugin-polyfill-node by copying its README and using a similar name. When its main module (dist/index.js) is required, it decodes base64-encoded strings to reconstruct and execute an npm install command for the svgson-lite package using child_process.spawn with hidden stdio and windowsHide options. After installation, it requires svgson-lite and invokes svgo.getPlugin()(), which executes attacker-controlled code inside the importing process. The use of base64 encoding is intended to evade static detection. This package is a supply chain threat that executes arbitrary code during module import.

This malicious package enables execution of arbitrary attacker-controlled code within the context of any project that imports rollup-packages-polyfill-core versions 0.13.7 or 0.13.8. This can lead to compromise of the development or build environment, potential data theft, persistence, or further malware deployment. The attack is triggered automatically on module import, increasing risk of unnoticed exploitation.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove rollup-packages-polyfill-core versions 0.13.7 and 0.13.8 from their dependencies and replace them with the legitimate rollup-plugin-polyfill-node package. Avoid installing packages with suspicious or similar names to popular packages. Monitor dependency trees for typosquatting or malicious packages. Since this is a malicious package, remediation involves removal and replacement rather than patching.