react-tabulix-ui @0.1.2

Summary

package.json declares a preinstall hook ( node./dist/index.d.js ) that runs automatically on npm install . The script at dist/index.d.js decodes a base64-wrapped payload via Buffer.from(..., 'base64').toString('utf-8') and dispatches it to eval , where the eval identifier is obfuscated by reconstructing it from the char-code array [101,118,97,108] and accessed via globalThis[tag](text) . The decoded payload fetches https://everydaynodechecker-39143n.vercel.app/api/key?mem=root2 and passes the response body to eval , resulting in execution of attacker-controlled code fetched from a remote endpoint on every installer's machine. The base64 wrapping, char-code eval reconstruction, and remote fetch-and-eval together form an install-time remote code execution chain against any consumer of this package.

Source: amazon-inspector (6e1730bc033ffe3e5cbe24819446e0c6d41af7bec46ec931a04eca2909ffc7cc)