The 'rollup-packages-polyfill-core' npm package, specifically versions 0.13.7 and 0.13.8, contains malicious code that, upon requiring its main entry point, decodes and executes a base64-encoded shell command to install an unpinned secondary malicious package 'vectormark' without saving it to the consumer's lockfile. It then dynamically requires and executes this second-stage package, enabling arbitrary code execution. The package name is a typosquat of the legitimate 'rollup-plugin-polyfill-node', and the malicious commands are obfuscated using base64 encoding to evade static analysis.

Any system with this package installed or running should be considered fully compromised. The attacker gains arbitrary code execution capabilities, potentially leading to complete system takeover. All secrets and keys on the affected system should be considered exposed and must be rotated immediately from a different, trusted system. Removing the package alone may not fully remediate the compromise due to potential persistence mechanisms.

Remove the 'rollup-packages-polyfill-core' package immediately. Rotate all secrets and keys stored on the affected system from a separate, secure environment. Because the system may be fully compromised, consider rebuilding the system or performing a thorough forensic analysis to ensure all malicious artifacts are removed. There is no official patch or fix; avoidance and removal are the primary mitigations.