MalwarePublished 5 Aug 2026

rollup-plugins-polyfills-rode (npm) · Malicious Code

Affects rollup-plugins-polyfills-rodeSource GCVE Database

Malicious package : remove rollup-plugins-polyfills-rode and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 17:03 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12430

What to do

Remove rollup-plugins-polyfills-rode from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmrollup-plugins-polyfills-rode	Affected =0.13.1 =0.13.2 =0.13.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package rollup-plugins-polyfills-rode versions 0.13.1, 0.13.2, and 0.13.3 is a typosquatted malicious package impersonating rollup-plugin-polyfill-node. When loaded, it executes hidden code that installs and runs an attacker-controlled package, enabling arbitrary code execution during the build process of any project that consumes this plugin.

Impact

Any developer or build system that installs and uses rollup-plugins-polyfills-rode versions 0.13.1, 0.13.2, or 0.13.3 will execute attacker-controlled code during the build process. This can lead to arbitrary code execution, compromising the build environment and potentially leading to further compromise of development infrastructure or software supply chain.

Defensive guidance

Avoid using rollup-plugins-polyfills-rode versions 0.13.1, 0.13.2, and 0.13.3. Remove this package from your dependencies and replace it with the legitimate rollup-plugin-polyfill-node package. Review your build environment for any signs of compromise if this package was previously used.

Summary

The package rollup-plugins-polyfills-rode@0.13.1 (and versions 0.13.2 and 0.13.3) is a typosquatting attack targeting the legitimate rollup-plugin-polyfill-node. Its dist/index.js contains top-level code that base64-decodes and executes a shell command to silently install an attacker-chosen npm package named 'cors-security'. It then requires this package and invokes a function from it, resulting in arbitrary code execution within the build environment. The malicious code is obfuscated using base64 encoding and includes a comment designed to mislead automated code reviewers. This behavior allows the attacker to execute arbitrary code on any machine that installs and uses this package as a Rollup plugin.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:03 UTC

Technical details

References

Community reviews