If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (5f2c7fe6586c3734730d6f8cd5ffe893c3f7cc5ff82710d1f4df22b8e76987e8)
The npm package rollup-plugins-check@0.0.2 declares a postinstall script (`node dist/module.js`) that, on `npm install`, performs an HTTPS GET to https://workconfig.vercel.app with `rejectUnauthorized: false` and passes the response body to `new Function('require', data)(require)`, executing the fetched code inside the installer's Node.js process with access to `require`. The remote body is opaque and controlled by whoever owns the endpoint; TLS certificate verification is explicitly disabled, so any on-path attacker can also substitute the payload. The package advertises itself as a rollup polyfill plugin and ships polyfill code copied from rollup-plugin-polyfill-node as cover, while the dropper is appended to the postinstall entry file. The name resembles the legitimate rollup-plugin-polyfill-node package.