MAL-2026-12429

    Dashboard / Malicious Package / MAL-2026-12429

    MAL-2026-12429

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in rollup-plugins-check (npm)

    Details: Source: amazon-inspector (5f2c7fe6586c3734730d6f8cd5ffe893c3f7cc5ff82710d1f4df22b8e76987e8) The npm package [email protected] declares a postinstall script (`node dist/module.js`) that, on `npm install`, performs an HTTPS GET to https://workconfig.vercel.app with `rejectUnauthorized: false` and passes the response body to `new Function('require', data)(require)`, executing the fetched code inside the installer's Node.js process with access to `require`. The remote body is opaque and controlled by whoever owns the endpoint; TLS certificate verification is explicitly disabled, so any on-path attacker can also substitute the payload. The package advertises itself as a rollup polyfill plugin and ships polyfill code copied from rollup-plugin-polyfill-node as cover, while the dropper is appended to the postinstall entry file. The name resembles the legitimate rollup-plugin-polyfill-node package.

    References: https://www.npmjs.com/package/rollup-plugins-check/v/0.0.1, https://www.npmjs.com/package/rollup-plugins-check/v/0.0.2

    Affected packages

    Package

    Name: rollup-plugins-check

    Purl: pkg:npm/rollup-plugins-check

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.1
    0.0.2
    MAL-2026-12429 | CVE-DB