MAL-2026-12428

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (dd41e8f4e3846a790a96f518bbdcfe70be2839531c5ea5485924e7fd25603399) The package is a typosquat of `rollup-plugin-polyfill-node`. On `require()` of the main entry (`dist/index.js`), a base64-encoded command `npm install cors-update --no-save --silent --no-audit --no-fund` is decoded and passed to `child_process.spawn` with `stdio:'ignore'` and `windowsHide:true`. When the install child exits, the code then base64-decodes the module name `cors-update`, dynamically `require`s it, and invokes `.getPlugin()()`, executing whatever code that separately-published package ships. The command string and the target module name are both stored as base64 literals to evade plain-text scanners. The package's advertised purpose (a Rollup Node polyfills plugin) does not require installing or executing any other npm package at import time.