rollup-packages-node-polyfills: Malicious npm security report | LPM Firewall

Loading npm security reports…

rollup-packages-node-polyfills: Malicious npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/index.jsView file

2L3: const inject = require('@rollup/plugin-inject'); L4: const modules = require('./modules.js');

Critical

Encoded Package Runner Execution

Source decodes numeric character arrays into a child-process package-runner command and executes it.

dist/index.jsView on unpkg · L2

•Trigger-reachable chain: manifest.main -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

83L84: const { spawn } = require('child_process'); L85:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L83

2L3: const inject = require('@rollup/plugin-inject'); L4: const modules = require('./modules.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L2

dist/polyfills.jsView file

2L3: const POLYFILLS = { "__http-lib/capability.js": "export var hasFetch = isFunction(global.fetch) && isFunction(global.ReadableStream)\n\nvar _blobConstructor;\nexport function blobC... L4:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/polyfills.jsView on unpkg · L2

2L3: const POLYFILLS = { "__http-lib/capability.js": "export var hasFetch = isFunction(global.fetch) && isFunction(global.ReadableStream)\n\nvar _blobConstructor;\nexport function blobC... L4:

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/polyfills.jsView on unpkg · L2

dist/modules.jsView file

•matchType = malicious_source_fingerprint_signature signature = 5fd85a3c8dfb2840 signatureType = suspicious_hashes sourceLabel = OpenSSF malicious-packages matchedPackage = rollup-packages-polyfill-core@0.13.8 matchedPath = dist/modules.js matchedIdentity = npm:[redacted]:0.13.8 similarity = 1.000 shingleOverlap = 5 summary = Malicious code in rollup-packages-polyfill-core (npm)

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/modules.jsView on unpkg

Source & flagged code

7 flagged

dist/index.jsView file

Lines 1-22javascript

1'use strict';

2

3const inject = require('@rollup/plugin-inject');

4const modules = require('./modules.js');

Critical

Encoded Package Runner Execution

Source decodes numeric character arrays into a child-process package-runner command and executes it.

dist/index.jsView on unpkg · L2

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L2

5const path = require('path');

6const crypto = require('crypto');

7const polyfills = require('./polyfills.js');

8

9// Node import paths use POSIX separators

10const { dirname, relative, join } = path.posix;

11const PREFIX = `\0polyfill-node.`;

12const PREFIX_LENGTH = PREFIX.length;

13function index (opts = {}) {

14 const mods = modules.getModules();

15 const injectPlugin = inject({

16 include: opts.include === undefined ? ['node_modules/**/*.js'] : opts.include,

17 exclude: opts.exclude,

18 sourceMap: opts.sourceMap,

19 modules: {

20 process: PREFIX + "process",

21 Buffer: [PREFIX + "buffer", "Buffer"],

22 global: PREFIX + 'global',

Lines 63-103javascript

63 }

64 if (id.startsWith(PREFIX)) {

65 const importee = id.substr(PREFIX_LENGTH).replace('.js', '');

66 return mods.

•Trigger-reachable chain: manifest.main -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

dist/polyfills.jsView file

Lines 1-6javascript

1'use strict';

2

3const POLYFILLS = { "__http-lib/capability.js": "export var hasFetch = isFunction(global.fetch) && isFunction(global.ReadableStream)\n\nvar _blobConstructor;\nexport function blobConstructor() {\n if (typeof _blobConstructor !== 'undefined') {\n return _blobConstructor;\n }\n try {\n

dist/modules.jsView file

•matchType = malicious_source_fingerprint_signature signature = 5fd85a3c8dfb2840 signatureType = suspicious_hashes sourceLabel = OpenSSF malicious-packages matchedPackage = rollup-packages-polyfill-core@0.13.8 matchedPath = dist/modules.js matchedIdentity = npm:[redacted]:0.13.8 similarity = 1.000 shingleOverlap = 5 summary = Malicious code in rollup-packages-polyfill-core (npm)

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/modules.jsView on unpkg