markdown-editable-table (npm) · Malicious Code
Affects markdown-editable-tableSource GCVE Database
Malicious package : remove markdown-editable-table and rotate any secrets on hosts that installed it.
Data as of 14 Jul 2026, 09:55 UTC
Malicious package
Published to npm · OSV MAL-2026-10452
What to do
Remove markdown-editable-table from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmmarkdown-editable-table | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'markdown-editable-table' versions 2.4.2, 2.4.3, and 2.4.4 contains malicious code that executes arbitrary JavaScript during installation via a preinstall hook. This code fetches and evaluates attacker-controlled scripts from a remote URL, effectively compromising the host machine. The package impersonates the legitimate 'markdown-table' package as a typosquat lure. Systems with this package installed should be considered fully compromised, and secrets should be rotated immediately.