The package react-dynamic-table-compenent version 1.2.7 is a malicious typosquatting npm package that executes arbitrary code on installation. Its postinstall script runs 'node dist/setup.js', which fetches JavaScript code from a remote URL and executes it using eval() in a function misleadingly named initDatabase. Because the fetched content is attacker-controlled and mutable, any installation of this package runs arbitrary code on the installer's machine. This represents a remote code execution threat delivered via supply chain compromise through a malicious package.

Any user who installs react-dynamic-table-compenent version 1.2.7 will execute attacker-controlled code on their system during the npm install process. This can lead to full compromise of the development or build environment, data theft, or further malware deployment. The malicious code is dynamically fetched and can change over time, increasing the risk and unpredictability of impact.

No official patch or remediation is currently documented. Users should avoid installing react-dynamic-table-compenent version 1.2.7 and verify package names carefully to avoid typosquatting attacks. Use trusted sources and package integrity verification where possible. Monitor vendor advisories for any updates or removal of the malicious package from npm.