react-icons-svgo@1.5.4

Analysis

react-icons-svgo is a combosquat of the real react-icons and svgo packages. Its index.js contains two base64-encoded strings. When the exported getPlugin() or setPlugin() functions are called (functions that recursively scan directories for .svg files, defaulting to ./script), the code decodes the first string and spawns a child process running: npm install rollup-plugin-polyfill-handler --no-save --silent --no-audit --no-fund. After installation, it requires the installed rollup-plugin-polyfill-handler package and executes its getPlugin() method — a second-stage dropper pattern. The npm install runs silently (stdio:ignore, windowsHide:true) with audit and funding checks disabled.