Malicious code in babel-polyfill-plugin-corejs2 (npm)

The package babel-polyfill-plugin-corejs2 version 1.0.1 advertises itself as a Babel core-js 2 polyfill plugin but contains unrelated web3-core-subscriptions boilerplate and a ~110KB obfuscated JavaScript payload executed immediately upon require(). The obfuscation includes random identifiers, numeric offset arrays, a TEA-like mixing routine, and unicode-escape string literals. This payload's purpose is opaque and unrelated to the declared functionality, indicating malicious intent. The presence of this package on a system implies full compromise, with potential unauthorized control and data exposure.

Any computer with this package installed or running should be considered fully compromised. Secrets and keys stored on the affected system are at risk and should be rotated immediately from a secure, unaffected machine. Removing the package alone may not eliminate all malicious software or backdoors installed by this payload, as full control may have been granted to an attacker.

Remove the babel-polyfill-plugin-corejs2 package version 1.0.1 immediately. Rotate all secrets and keys stored on the affected system from a different, secure computer. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the system to ensure removal of all malicious components. No official patch or fix is available; the package itself is malicious.