The react-icons-svgo package versions 1.0.0, 1.5.3, and 1.5.4 include base64-encoded literals that decode to a shell command installing the rollup-plugin-polyfill-handler module without saving it to dependencies. Upon invoking advertised API functions related to SVG validation, the package decodes and executes this command silently, then requires and runs the installed module's getPlugin() function. Since the installed package is fully controlled by a third party and not declared in dependencies, this results in arbitrary remote code execution within the Node.js process using react-icons-svgo.

This vulnerability allows an attacker controlling the third-party package rollup-plugin-polyfill-handler to execute arbitrary code on any system that installs and uses the affected react-icons-svgo versions. The code executes with the privileges of the Node.js process, potentially leading to full system compromise or further malicious activity. The malicious package masquerades as a legitimate utility, increasing the risk of inadvertent installation and exploitation.

No official patch or remediation is currently documented. Users should avoid installing or using react-icons-svgo versions 1.0.0, 1.5.3, and 1.5.4. Remove the package from projects and replace it with trusted alternatives. Monitor vendor advisories for updates or official fixes. Since this is a malicious package, consider auditing dependencies for similar typosquatting or impersonation attempts.