Malicious npm packages impersonating the legitimate rollup-plugin-polyfill-node project. Each package embeds a staged infostealer/backdoor that runs on install, harvesting SSH keys, cloud credentials (AWS), environment variables, browser profiles, editor histories, and crypto-wallet data, and grants remote shell/command execution, clipboard and screenshot surveillance, and SSH-based lateral movement. All published versions are malicious.