The package [email protected] (and versions 0.13.2 and 0.13.3) is a typosquatting attack targeting the legitimate rollup-plugin-polyfill-node. Its dist/index.js contains top-level code that base64-decodes and executes a shell command to silently install an attacker-chosen npm package named 'cors-security'. It then requires this package and invokes a function from it, resulting in arbitrary code execution within the build environment. The malicious code is obfuscated using base64 encoding and includes a comment designed to mislead automated code reviewers. This behavior allows the attacker to execute arbitrary code on any machine that installs and uses this package as a Rollup plugin.

Any developer or build system that installs and uses rollup-plugins-polyfills-rode versions 0.13.1, 0.13.2, or 0.13.3 will execute attacker-controlled code during the build process. This can lead to arbitrary code execution, compromising the build environment and potentially leading to further compromise of development infrastructure or software supply chain.

Avoid using rollup-plugins-polyfills-rode versions 0.13.1, 0.13.2, and 0.13.3. Remove this package from your dependencies and replace it with the legitimate rollup-plugin-polyfill-node package. Since no official patch or fix is indicated, the safest mitigation is to cease usage of this typosquatted package. Review your build environment for any signs of compromise if this package was previously used.