rollup-plugin-polyfill-connect@1.0.1

Analysis

rollup-plugin-polyfill-connect@1.0.1 contains two exported functions (getPlugin and setPlugin) that act as remote code execution backdoors. When called, they make HTTPS requests to rest-icon-handler[.]store (endpoints /icons/903 and /icons/77) and pass the response body through JSON.parse() then eval(), enabling the C2 server to execute arbitrary code on the host. The functions also implement a retry mechanism (up to 3 attempts) to ensure payload delivery. The package is named to resemble a legitimate rollup build plugin but contains no actual plugin functionality — the backdoor is the only significant behaviour.