The npm package rollup-plugins-check versions 0.0.1 and 0.0.2 contains malicious code that executes arbitrary JavaScript fetched from a remote server during installation. This code disables TLS certificate verification, allowing attackers to intercept and modify the payload. The package masquerades as a legitimate rollup polyfill plugin but includes a postinstall script that runs potentially harmful code with full access to Node.js require functionality.