The npm package [email protected] includes a postinstall script that performs an HTTPS GET request to a remote endpoint (https://workconfig.vercel.app) with TLS certificate verification disabled (rejectUnauthorized: false). The response body from this request is executed as JavaScript code within the installer's Node.js process using new Function, granting the fetched code access to the require function and thus the ability to load modules and execute arbitrary code. The package attempts to appear legitimate by copying polyfill code from rollup-plugin-polyfill-node, but the malicious payload is appended to the postinstall script. The disabled TLS verification also enables man-in-the-middle attackers to substitute the payload during installation.

Users installing [email protected] or 0.0.2 risk executing arbitrary, attacker-controlled code on their systems with the privileges of the Node.js process running npm install. This can lead to compromise of the development environment, theft of sensitive data, or further malware deployment. The lack of TLS verification increases the risk of interception and payload substitution by network attackers.

No official patch or remediation is currently documented. Users should avoid installing rollup-plugins-check versions 0.0.1 and 0.0.2. Verify package authenticity before installation, prefer official and well-maintained packages, and monitor for vendor advisories regarding this package. Since this is a malicious package, removal from projects and dependency trees is recommended.