MAL-2026-12425

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-table-core/MAL-2026-12425.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12425
Published
2026-08-05T12:47:52Z
Modified
2026-08-05T13:35:49.614568761Z
Summary
Malicious code in react-table-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dcbd9a8090832d59bcf70ff418611d54c1f558eb0a09927fc13895f5d654f02c)

package.json declares preinstall: node./dist/index.d.js, disguising an executable loader as a TypeScript declaration file. On npm install, that loader reads an AES-256-CBC ciphertext assembled at runtime by concatenating four fields (title/subtitle/description/tag) of a TASK_CONTENT object exported from./config.js, decrypts it with a hardcoded key and IV via crypto.createDecipheriv('aes-256-cbc', wad, ray), and passes the plaintext to eval — where eval is obtained by building the string from the char-code array [101,118,97,108] and looking it up on globalThis. This yields arbitrary attacker-controlled code execution on every machine that installs the package. The package is named react-table-core (typosquatting the popular react-table / @tanstack/react-table libraries) while the README is titled react-tabulix-query with unrelated Tabulix branding — the name/README mismatch is the lure for installations. Splitting the ciphertext across metadata-shaped fields, hiding the loader behind a .d.js extension, and reconstructing eval from char codes have no legitimate purpose in a React table utility.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T12:47:52Z",
            "id": "IN-MAL-2026-014765",
            "import_time": "2026-08-05T13:08:44.798768911Z",
            "versions": [
                "2.7.1"
            ],
            "source": "amazon-inspector",
            "sha256": "dcbd9a8090832d59bcf70ff418611d54c1f558eb0a09927fc13895f5d654f02c"
        }
    ]
}
References
Credits

Affected packages

npm / react-table-core

Package

Name
react-table-core
View open source insights on deps.dev
Purl
pkg:npm/react-table-core

Affected ranges

Affected versions

2.*
2.7.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-3hx0G78xn6pIXhPOXakndBrd5Y1S9EZKZT7gaz2D802F172hvtqMiP91D60wjEg3Ge4H2ZDElQNQ+9T2Ms77Jg==",
                "sha1": "ced84b8179cec5f6502a489ddeddfeded0551d3d"
            },
            "filename": "react-table-core-2.7.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/index.d.js",
            "tlsh": "7e11c0310b67f5b120157ecb74b78402e6f1d653362dc6d4fa0c88ea8ab1c91c2d02f0",
            "sha256": "6315d2a825209c7cbc4a5c2eb7a2e0a2b2614bf04d91cb251d07b12904574cb2"
        },
        {
            "path": "dist/config.js",
            "tlsh": "62d02b134bc7381284a5159a5d838451f5a4032fe862501379f508528b3adabebc79c1",
            "sha256": "a3049e345080519c737d9e26ee57918a878f4958523f80521614ac0fe727afba"
        },
        {
            "path": "package.json",
            "tlsh": "45216823c5904da358f692f9b8310757f1665b0f12608e0b31fa912c0fb66eb015fbba",
            "sha256": "f9f49c1298938971b8b6d9bd0b8c5f1b04e92199d13d840779e00f25ba38a8a5"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-table-core/MAL-2026-12425.json"