MAL-2026-12429 Malicious code in rollup-plugins-check (npm)

The npm package [email protected] declares a postinstall script (node dist/module.js) that, on npm install, performs an HTTPS GET to https://workconfig.vercel.app with rejectUnauthorized: false and passes the response body to new Function('require', data)(require), executing the fetched code inside the installer's Node.js process with access to require. The remote body is opaque and controlled by whoever owns the endpoint; TLS certificate verification is explicitly disabled, so any on-path attacker can also substitute the payload. The package advertises itself as a rollup polyfill plugin and ships polyfill code copied from rollup-plugin-polyfill-node as cover, while the dropper is appended to the postinstall entry file. The name resembles the legitimate rollup-plugin-polyfill-node package.