LWA-2026-6980 MAL-2026-11478 ↗ confirmed malware

rollup-plugin-polyfill-helper@1.0.1

Malicious code in rollup-plugin-polyfill-helper (npm)

T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1071.001 · Web ProtocolsT1105 · Ingress Tool Transfer

Analysis

rollup-plugin-polyfill-helper is a combosquat package impersonating a rollup polyfill plugin. When required, it fetches JavaScript payloads from rest-icon-helper[.]store (paths /icons/303 and /icons/389) and executes them via eval(JSON.parse(body)), giving the remote server full control over the runtime. The package exports getPlugin(), setPlugin(), and getPluginExten() functions that perform this fetch-and-eval with retry logic. On non-Windows systems the first payload runs immediately and a second is scheduled 60 seconds later; on Windows the second payload runs directly. The package has no actual rollup plugin interface and no repository.

analyzed by
Leitwacht
first seen
Jul 21, 2026, 08:16 PM
analyzed
Jul 21, 2026, 08:17 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.