VulnerabilityPublished 07/13/2026

Malicious code in markable-table (npm)

Affects markable-tableSource GCVE Database

Severity

Critical

Rated by Threat Radar

Data as of 09/17/2026, 20:05:39 UTC

What to do

Affected software

Product	Affected	Fixed in
npmmarkable-table	Affected =3.1.2 =3.1.4 =3.1.3 =3.1.8 =3.1.6 =3.1.7 =3.1.5 =3.1.1 =3.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

There is no known patch or official fix available for this malicious package. The package should be immediately removed from all systems. All credentials and secrets on affected systems must be rotated from a different, uncompromised machine. Due to the nature of the compromise, full system reimaging or forensic analysis is recommended to ensure no persistent backdoors remain.

Description

The npm package 'markable-table' versions 3.1.0 through 3.1.8 contains malicious code that executes arbitrary JavaScript fetched from a remote server during installation. This is achieved by obfuscated code that hides the use of 'eval' to run the fetched payload, enabling remote code execution on any machine running 'npm install' for this package. The package is a typosquat of the legitimate 'markdown-table' package and its behavior is inconsistent with its advertised purpose. Systems with this package installed should be considered fully compromised.

Impact

Any system that installs or runs this package is at risk of full compromise, as the attacker can execute arbitrary code remotely during installation. This can lead to unauthorized access, data theft, installation of further malware, and loss of control over the affected system. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately from a secure environment.

Summary

The 'markable-table' npm package versions 3.1.0 through 3.1.8 includes a preinstall script that runs 'node index.d.js'. This script base64-decodes an embedded payload and uses an obfuscated 'eval' call to execute JavaScript code fetched from a remote URL hosted on a non-first-party Vercel domain. This results in arbitrary code execution at install time, allowing the remote operator to execute any code on the affected system. The package's name and functionality mismatch, along with obfuscation techniques, indicate a malicious intent consistent with an install-time remote code execution dropper.

References

Community reviews

Loading reviews…