Baike.dev
Log in
Back to tool/Back to issues
#5821·rollup

Trojan detected in @rollup\rollup-win32-x64-msvc\rollup.win32-x64-msvc.node by Windows Security

Author: ravindranagCreated Feb 1, 2025Updated Mar 25, 2026
Labelst¹ 🐞 bugt⁸ ⋅ triage

Rollup Version

v4.34.0

Operating System (or Browser)

Windows 11

Node Version (if applicable)

v22.13.1

Link To Reproduction

https://github.com/ravindranag/rollup-bug

Expected Behaviour

Running npm run dev should start the vite server successfully.

Actual Behaviour

Upon running npm run dev, I am getting the following error.

I can confirm the file in question is installed successfully after running npm i. It is when I try to run the npm run dev command that Windows Security detects a threat and removes the file, causing the vite server to fail.


> [email protected] dev
> vite

D:\Personal\rollup-bug\node_modules\rollup\dist\native.js:64
                throw new Error(
                      ^

Error: Cannot find module @rollup/rollup-win32-x64-msvc. npm has a bug related to optional dependencies (https://github.com/npm/cli/issues/4828). Please try `npm i` again after removing both package-lock.json and node_modules directory.
    at requireWithFriendlyError (D:\Personal\rollup-bug\node_modules\rollup\dist\native.js:64:9)
    at Object.<anonymous> (D:\Personal\rollup-bug\node_modules\rollup\dist\native.js:73:76)
    at Module._compile (node:internal/modules/cjs/loader:1562:14)
    at Object..js (node:internal/modules/cjs/loader:1699:10)
    at Module.load (node:internal/modules/cjs/loader:1313:32)
    at Function._load (node:internal/modules/cjs/loader:1123:12)
    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:217:24)
    at cjsLoader (node:internal/modules/esm/translators:263:5)
    at ModuleWrap.<anonymous> (node:internal/modules/esm/translators:196:7) {
  [cause]: Error: Cannot find module 'D:\Personal\rollup-bug\node_modules\@rollup\rollup-win32-x64-msvc\rollup.win32-x64-msvc.node'. Please verify that the package.json has a valid "main" entry
      at tryPackage (node:internal/modules/cjs/loader:492:19)
      at Function._findPath (node:internal/modules/cjs/loader:790:18)
      at Function._resolveFilename (node:internal/modules/cjs/loader:1230:27)
      at Function._load (node:internal/modules/cjs/loader:1070:27)
      at TracingChannel.traceSync (node:diagnostics_channel:322:14)
      at wrapModuleLoad (node:internal/modules/cjs/loader:217:24)
      at Module.require (node:internal/modules/cjs/loader:1335:12)
      at require (node:internal/modules/helpers:136:16)
      at requireWithFriendlyError (D:\Personal\rollup-bug\node_modules\rollup\dist\native.js:46:10)
      at Object.<anonymous> (D:\Personal\rollup-bug\node_modules\rollup\dist\native.js:73:76) {
    code: 'MODULE_NOT_FOUND',
    path: '\\\\?\\D:\\Personal\\rollup-bug\\node_modules\\@rollup\\rollup-win32-x64-msvc\\package.json',
    requestPath: '@rollup/rollup-win32-x64-msvc'
  }
}

Node.js v22.13.1

Windows Security logs: image

Workaround

Downgrading to [email protected] gets everything working. Windows Security does not remove the file anymore. Add the following override in package.json:

  "overrides": {
    "rollup": "4.32.1"
  }

Source: rollup/rollup

View original on GitHubView discussion on GitHub