MAL-2026-12425 Malicious code in react-table-core (npm)

package.json declares preinstall: node./dist/index.d.js, disguising an executable loader as a TypeScript declaration file. On npm install, that loader reads an AES-256-CBC ciphertext assembled at runtime by concatenating four fields (title/subtitle/description/tag) of a TASK_CONTENT object exported from./config.js, decrypts it with a hardcoded key and IV via crypto.createDecipheriv('aes-256-cbc', wad, ray), and passes the plaintext to eval — where eval is obtained by building the string from the char-code array [101,118,97,108] and looking it up on globalThis. This yields arbitrary attacker-controlled code execution on every machine that installs the package. The package is named react-table-core (typosquatting the popular react-table / @tanstack/react-table libraries) while the README is titled react-tabulix-query with unrelated Tabulix branding — the name/README mismatch is the lure for installations. Splitting the ciphertext across metadata-shaped fields, hiding the loader behind a .d.js extension, and reconstructing eval from char codes have no legitimate purpose in a React table utility.