registry / Remote code execution / rollup-plugin-polyfill-helper
rollup-plugin-polyfill-helper
A Node.js toolkit for fetching SVG icons and CDN resources.
This report shows the evidence for rollup-plugin-polyfill-helper@1.0.5. 6 of 6 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource establishes a concrete remote-code-execution path when an exported API is called. Absence of lifecycle hooks reduces install-time scope but does not remove the malicious runtime capability.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer invokes getPlugin, setPlugin, or getPluginExten.
Impact
Remote code execution in the consuming Node.js process.
Mechanism
HTTP payload fetch followed by eval(JSON.parse(response)).
Attack narrative
The exported getPlugin, setPlugin, and getPluginExten functions request fixed endpoints at rest-icon-handler.store and pass a JSON-decoded response directly to eval. getPlugin additionally schedules getPluginExten after one minute, enabling a second remote stage. This is remote payload execution unrelated to the documented SVG-fetching purpose.
AI rationale
Source establishes a concrete remote-code-execution path when an exported API is called. Absence of lifecycle hooks reduces install-time scope but does not remove the malicious runtime capability.
Evidence
package.jsonindex.jsREADME.md
Network endpoints2
rest-icon-handler.store/icons/103rest-icon-handler.store/icons/389
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js exports three functions that fetch remote bodies and execute eval(JSON.parse(b)).
- getPlugin calls https://rest-icon-handler.store/icons/103, then schedules getPluginExten after 60 seconds.
- getPluginExten fetches /icons/389 and evals the returned parsed value.
- README describes icon fetching, not executing arbitrary remote JavaScript.
Evidence against
- package.json has no install or lifecycle hook.
- No local file, credential, or child-process access appears in inspected source.
Behavioral surface
EvalNetwork
Source & flagged code
1 flagged · loading sourceindex.jsView file
118try {
L119: eval(JSON.parse(b));
L120: } catch (err) {
High
Findings
1 High1 Medium1 Low
HighEvalindex.js
MediumNetwork
LowScripts Present
Affected versions and remediation
This report applies to rollup-plugin-polyfill-helper@1.0.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing rollup-plugin-polyfill-helper@1.0.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.