rollup-plugin-polyfill-hold@1.0.5
Malicious code in rollup-plugin-polyfill-hold (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1105 · Ingress Tool TransferT1071.001 · Web Protocols
Analysis
The package exports functions (getPlugin, setPlugin, getPluginExten) that fetch JSON from hxxps://rest-icon-handler[.]store/icons/ and pass the response body to eval(), executing arbitrary remote code. The C2 host is rest-icon-handler[.]store, accessed via paths /icons/103 and /icons/389. The package is a combosquat on the legitimate rollup-plugin-polyfill name with "hold" appended, and its described purpose as a CDN icon fetcher is a cover for the remote code execution behaviour.
- analyzed by
- Leitwacht
- first seen
- Jul 31, 2026, 01:49 PM
- analyzed
- Jul 31, 2026, 01:50 PM
Related advisories
- ts-poly-utls@1.2.4
- postcss-animate-css-vars@2.0.3
- log-min@1.0.13
- streak-metrics-math@1.0.1
- runtime-sentinel@1.0.2
- streak-math-metrics@1.0.0
- akamai-sensorv3@1.0.0
- streak-metrics-core@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.