react-tabulix-query @0.1.3

Summary

The package's package.json preinstall script runs dist/index.d.js, which base64-decodes an embedded payload and executes it. The decoded payload uses fetch() to retrieve code from https://everydaynodechecker-39143n.vercel.app/api/key?mem=root0 and passes the response body to eval, granting the remote endpoint arbitrary code execution on the installer's machine at npm install time. The eval identifier is reconstructed from a char-code array ([101,118,97,108]) and invoked via globalThis[tag](text) to hide the sink from naive scanners. The filename index.d.js mimics a TypeScript declaration file to further disguise the dropper. There is no legitimate library functionality; the package's only observable behavior is the remote fetch-and-execute.

Source: amazon-inspector (413e61124e5f46f550114ce54d841c1dc68b4dc3a9d0939c8f3c021a6c790a65)