Hostile 100% javascript Download

rollup-packages-polyfill-core 0.13.9

Base64 obfuscated malicious install command

SVG decoy wrapper around staged module loadSilent spawn + decoded module name require chain
SHA-256212b226c963dc270dbfd5cabd112fe67f932c851af90c40e8c6bf50fe9b111e6
URLhttps://registry.npmjs.org/rollup-packages-polyfill-core/-/rollup-packages-polyfill-core-0.13.9.tgz
MaleculeK₂(McLi₂)O₂(CS₂)H₇(Cm₉Cr₂Db₉FOs₄Po₈U)Md₃(InPa₅)

Also flagged by osv (MAL-2026-10160: Malicious code in rollup-packages-polyfill-core (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.