# MAL-2026-12425: Malicious code in react-table-core (npm)


- **Type:** Malicious package
- **Package:** `react-table-core` (npm)
- **Published:** 5 Aug 2026

## What is MAL-2026-12425?

MAL-2026-12425 is a malicious package in react-table-core, published on 5 Aug 2026. 

### Official description

package.json declares `preinstall: node./dist/index.d.js`, disguising an executable loader as a TypeScript declaration file. On `npm install`, that loader reads an AES-256-CBC ciphertext assembled at runtime by concatenating four fields (title/subtitle/description/tag) of a TASK_CONTENT object exported from./config.js, decrypts it with a hardcoded key and IV via `crypto.createDecipheriv('aes-256-cbc', wad, ray)`, and passes the plaintext to `eval` — where `eval` is obtained by building the string from the char-code array [101,118,97,108] and looking it up on `globalThis`. This yields arbitrary attacker-controlled code execution on every machine that installs the package. The package is named `react-table-core` (typosquatting the popular `react-table` / `@tanstack/react-table` libraries) while the README is titled `react-tabulix-query` with unrelated Tabulix branding — the name/README mismatch is the lure for installations. Splitting the ciphertext across metadata-shaped fields, hiding the loader behind a `.d.js` extension, and reconstructing `eval` from char codes have no legitimate purpose in a React table utility.

## What should I do about MAL-2026-12425?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-12425 is a malicious package: react-table-core (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-12425/ (Markdown: https://insights.sbomify.com/MAL-2026-12425/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-12425

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-12425/
Summaries are generated and may contain mistakes; the official description above is the record.