The react-dynammic-table-component npm package version 1.2.7 declares a preinstall lifecycle script that runs automatically on npm install. This script performs an HTTPS GET request to an attacker-controlled domain and passes the response body directly to eval(), executing arbitrary JavaScript code on the installer's machine with the user's privileges. The malicious code is hidden inside a function named initDatabase, which does not perform any database operations but serves as a cover story. Because the fetched code is unpinned and mutable by the attacker, they can change the executed payload at any time without republishing the package. This allows for a wide range of malicious activities including credential theft, persistence, lateral movement, and dependency tampering.

Any user installing react-dynammic-table-component version 1.2.7 will execute attacker-controlled code with their user privileges during installation. This can lead to credential theft, installation of persistent malware, lateral movement within networks, tampering with dependencies, and other malicious actions. The impact is immediate and unbounded due to the dynamic and unverified nature of the fetched code.

No official patch or remediation is currently available for this malicious package version. Users should avoid installing react-dynammic-table-component version 1.2.7. If already installed, remove the package and audit systems for compromise. Use trusted package sources and verify package integrity before installation. Monitor vendor advisories for updates or official fixes.