Critical Malicious Code Vulnerability in rollup-plugin-polyfill-swc Package
Summary
MAL-2026-976: Malicious code in rollup-plugin-polyfill-swc (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rollup-plugin-polyfill-swc package is a tool used in JavaScript development to enable polyfilling for modern JavaScript features. It allows developers to write code using the latest JavaScript syntax while ensuring compatibility with older browsers. However, this package has been identified as containing malicious code, posing significant security risks to any system where it is installed.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the rollup-plugin-polyfill-swc package. This code can compromise any computer that has the package installed, leading to unauthorized access and control by external entities. The ramifications include potential data breaches, loss of sensitive information, and the possibility of further malware installation. The vulnerability is classified under CWE-506, indicating the presence of embedded malicious code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall rollup-plugin-polyfill-swcIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the affected package. It is recommended to monitor your project for any dependencies that may rely on rollup-plugin-polyfill-swc and replace them with secure alternatives.
Conclusion
The rollup-plugin-polyfill-swc package has been identified as containing malicious code, which poses serious security risks to any system using it. Immediate removal of the package and rotation of sensitive information is essential to mitigate potential damage. Users are encouraged to monitor their dependencies and utilize tools like Vulert for ongoing vulnerability management.
See every vulnerability recorded for rollup-plugin-polyfill-swc →
FAQ
Immediately remove the package from your project and rotate any sensitive information stored on the affected system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Currently, there is no patched version available. The best course of action is to remove the package entirely.
Failure to address this vulnerability can lead to unauthorized access to your system, data breaches, and potential further malware infections.
It is highly discouraged to continue using the package, as it poses a significant security risk regardless of the data stored on the system.
