rollup-plugins-check@0.0.1

Analysis

The postinstall script (dist/module.js) makes an HTTPS GET request to workconfig[.]vercel[.]app (with TLS verification disabled) and passes the response body into new Function('require', data)(require), executing arbitrary remote code on the installer's machine with full Node.js require() access. The package claims to be a rollup polyfill plugin and references the legitimate FredKSchott/rollup-plugin-polyfill-node repository, but ships a malicious install-time downloader instead. IOC: workconfig[.]vercel[.]app (HTTPS).