rollup-plugins-polyfills-rode@0.13.4

Analysis

Combosquat of the legitimate rollup-plugin-polyfill-node package. The postinstall script (dist/module.js) makes an HTTPS GET request to api[.]avax-test[.]dev/ext/bc/rpc with certificate validation disabled, then passes the response body to new Function('require', data)(require), executing arbitrary remote code at install time. The rest of the package contains legitimate browser polyfill code; the malicious payload is confined to the postinstall hook.