{"answers":{"affected":"1 open source package ship an affected version, including react-table-core.","exploited":"There is no known exploitation of MAL-2026-12425 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12425 is a malicious package in react-table-core, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12425 is a malicious package: react-table-core (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12425/ (Markdown: https://insights.sbomify.com/MAL-2026-12425/index.md)","id":"MAL-2026-12425","markdown":"https://insights.sbomify.com/MAL-2026-12425/index.md","name":"MAL-2026-12425","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"package.json declares `preinstall: node./dist/index.d.js`, disguising an executable loader as a TypeScript declaration file. On `npm install`, that loader reads an AES-256-CBC ciphertext assembled at runtime by concatenating four fields (title/subtitle/description/tag) of a TASK_CONTENT object exported from./config.js, decrypts it with a hardcoded key and IV via `crypto.createDecipheriv('aes-256-cbc', wad, ray)`, and passes the plaintext to `eval` — where `eval` is obtained by building the string from the char-code array [101,118,97,108] and looking it up on `globalThis`. This yields arbitrary attacker-controlled code execution on every machine that installs the package. The package is named `react-table-core` (typosquatting the popular `react-table` / `@tanstack/react-table` libraries) while the README is titled `react-tabulix-query` with unrelated Tabulix branding — the name/README mismatch is the lure for installations. Splitting the ciphertext across metadata-shaped fields, hiding the loader behind a `.d.js` extension, and reconstructing `eval` from char codes have no legitimate purpose in a React table utility.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in react-table-core (npm)","id":"MAL-2026-12425","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"react-table-core","purl":"pkg:npm/react-table-core","source":"MAL-2026-12425"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12425/"}