rollup-packages-node-polyfills@0.13.2

Summary

The package is a typosquat of rollup-plugin-polyfill-node. On require() of the main entry (dist/index.js), a base64-encoded command npm install cors-update --no-save --silent --no-audit --no-fund is decoded and passed to child_process.spawn with stdio:'ignore' and windowsHide:true. When the install child exits, the code then base64-decodes the module name cors-update, dynamically requires it, and invokes .getPlugin()(), executing whatever code that separately-published package ships. The command string and the target module name are both stored as base64 literals to evade plain-text scanners. The package's advertised purpose (a Rollup Node polyfills plugin) does not require installing or executing any other npm package at import time.

Source: amazon-inspector (dd41e8f4e3846a790a96f518bbdcfe70be2839531c5ea5485924e7fd25603399)