MAL-2026-12425

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (dcbd9a8090832d59bcf70ff418611d54c1f558eb0a09927fc13895f5d654f02c) package.json declares `preinstall: node./dist/index.d.js`, disguising an executable loader as a TypeScript declaration file. On `npm install`, that loader reads an AES-256-CBC ciphertext assembled at runtime by concatenating four fields (title/subtitle/description/tag) of a TASK_CONTENT object exported from./config.js, decrypts it with a hardcoded key and IV via `crypto.createDecipheriv('aes-256-cbc', wad, ray)`, and passes the plaintext to `eval` — where `eval` is obtained by building the string from the char-code array [101,118,97,108] and looking it up on `globalThis`. This yields arbitrary attacker-controlled code execution on every machine that installs the package. The package is named `react-table-core` (typosquatting the popular `react-table` / `@tanstack/react-table` libraries) while the README is titled `react-tabulix-query` with unrelated Tabulix branding — the name/README mismatch is the lure for installations. Splitting the ciphertext across metadata-shaped fields, hiding the loader behind a `.d.js` extension, and reconstructing `eval` from char codes have no legitimate purpose in a React table utility.