registry / rollup-plugin-polyfill-helper / 1.0.5

rollup-plugin-polyfill-helper@1.0.5

A Node.js toolkit for fetching SVG icons and CDN resources.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Explicit calls to exported plugin functions retrieve attacker-controlled remote content and execute it as JavaScript. The first call can schedule a second payload fetch.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer invokes getPlugin, setPlugin, or getPluginExten.

Impact

Remote code execution in the consuming Node.js process.

Mechanism

HTTP payload fetch followed by eval(JSON.parse(response)).

Attack narrative

The exported getPlugin, setPlugin, and getPluginExten functions request fixed endpoints at rest-icon-handler.store and pass a JSON-decoded response directly to eval. getPlugin additionally schedules getPluginExten after one minute, enabling a second remote stage. This is remote payload execution unrelated to the documented SVG-fetching purpose.

Rationale

Source establishes a concrete remote-code-execution path when an exported API is called. Absence of lifecycle hooks reduces install-time scope but does not remove the malicious runtime capability.

Evidence

package.jsonindex.jsREADME.md

Network endpoints2

rest-icon-handler.store/icons/103rest-icon-handler.store/icons/389

Decision evidence

public snapshot

rollup-plugin-polyfill-helper@1.0.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code