rollup-runtime-polyfill-core@0.13.5

Analysis

Package named to impersonate a legitimate rollup polyfill plugin. At require-time (no install hook needed), dist/index.js spawns a hidden child process to silently install a second-stage npm package "2fa-exe" (command is base64-encoded and decoded at runtime: npm install 2fa-exe --no-save --silent --no-audit --no-fund). After installation, the package requires 2fa-exe and executes its getPlugin() function. The malicious code is appended below legitimate polyfill code to evade casual inspection. All network IOCs are mediated through the npm registry for the second-stage package 2fa-exe.