The npm package rollup-plugins-polyfills-rode versions 0.13.1, 0.13.2, and 0.13.3 is a typosquatted malicious package impersonating rollup-plugin-polyfill-node. When loaded, it executes hidden code that installs and runs an attacker-controlled package, enabling arbitrary code execution during the build process of any project that consumes this plugin.