react-table-core

{"modified":"2026-08-05T12:47:52Z","published":"2026-08-05T12:47:52Z","schema_version":"1.7.4","id":"MAL-2026-12425","summary":"Malicious code in react-table-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dcbd9a8090832d59bcf70ff418611d54c1f558eb0a09927fc13895f5d654f02c)\npackage.json declares `preinstall: node./dist/index.d.js`, disguising an executable loader as a TypeScript declaration file. On `npm install`, that loader reads an AES-256-CBC ciphertext assembled at runtime by concatenating four fields (title/subtitle/description/tag) of a TASK_CONTENT object exported from./config.js, decrypts it with a hardcoded key and IV via `crypto.createDecipheriv('aes-256-cbc', wad, ray)`, and passes the plaintext to `eval` — where `eval` is obtained by building the string from the char-code array [101,118,97,108] and looking it up on `globalThis`. This yields arbitrary attacker-controlled code execution on every machine that installs the package. The package is named `react-table-core` (typosquatting the popular `react-table` / `@tanstack/react-table` libraries) while the README is titled `react-tabulix-query` with unrelated Tabulix branding — the name/README mismatch is the lure for installations. Splitting the ciphertext across metadata-shaped fields, hiding the loader behind a `.d.js` extension, and reconstructing `eval` from char codes have no legitimate purpose in a React table utility.\n","affected":[{"package":{"ecosystem":"npm","name":"react-table-core"},"versions":["2.7.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.d.js","sha256":"6315d2a825209c7cbc4a5c2eb7a2e0a2b2614bf04d91cb251d07b12904574cb2","tlsh":"7e11c0310b67f5b120157ecb74b78402e6f1d653362dc6d4fa0c88ea8ab1c91c2d02f0"},{"path":"dist/config.js","sha256":"a3049e345080519c737d9e26ee57918a878f4958523f80521614ac0fe727afba","tlsh":"62d02b134bc7381284a5159a5d838451f5a4032fe862501379f508528b3adabebc79c1"},{"path":"package.json","sha256":"f9f49c1298938971b8b6d9bd0b8c5f1b04e92199d13d840779e00f25ba38a8a5","tlsh":"45216823c5904da358f692f9b8310757f1665b0f12608e0b31fa912c0fb66eb015fbba"}],"package_integrity":[{"filename":"react-table-core-2.7.1.tgz","hashes":{"sha1":"ced84b8179cec5f6502a489ddeddfeded0551d3d","sha512_sri":"sha512-3hx0G78xn6pIXhPOXakndBrd5Y1S9EZKZT7gaz2D802F172hvtqMiP91D60wjEg3Ge4H2ZDElQNQ+9T2Ms77Jg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/react-table-core/v/2.7.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014765","import_time":"2026-08-05T13:08:44.798768911Z","modified_time":"2026-08-05T12:47:52Z","sha256":"dcbd9a8090832d59bcf70ff418611d54c1f558eb0a09927fc13895f5d654f02c","source":"amazon-inspector","versions":["2.7.1"]}]}}