rollup-plugin-polyfill-helper@1.0.1
Malicious code in rollup-plugin-polyfill-helper (npm)
Analysis
rollup-plugin-polyfill-helper is a combosquat package impersonating a rollup polyfill plugin. When required, it fetches JavaScript payloads from rest-icon-helper[.]store (paths /icons/303 and /icons/389) and executes them via eval(JSON.parse(body)), giving the remote server full control over the runtime. The package exports getPlugin(), setPlugin(), and getPluginExten() functions that perform this fetch-and-eval with retry logic. On non-Windows systems the first payload runs immediately and a second is scheduled 60 seconds later; on Windows the second payload runs directly. The package has no actual rollup plugin interface and no repository.
- analyzed by
- Leitwacht
- first seen
- Jul 21, 2026, 08:16 PM
- analyzed
- Jul 21, 2026, 08:17 PM
Related advisories
- 1239i32049i@0.1.0
- faust-cont@1.0.0
- quickbuf@1.0.1
- consumerweb-calurls@99.9.1
- consumerweb-creditcollection@99.9.1
- cxpw-offers@99.9.1
- app-data-ist@2.1.6
- requestor-util@99.9.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.