The package react-dynamic-table-compenent (version 1.2.7) is a malicious typosquatting package on npm that mimics react-dynamic-table-component with a one-letter misspelling. Its postinstall script runs 'node dist/setup.js', which fetches content from a remote URL and executes it via eval() inside a function named initDatabase. Because the fetched content is attacker-controlled and mutable, any installation of this package results in arbitrary remote code execution on the victim's machine. This behavior effectively gives the attacker full control over the compromised system. The package's naming attempts to disguise the malicious activity as benign configuration loading. Due to the nature of the compromise, simply removing the package may not eliminate all malicious artifacts.

Installation of this package leads to arbitrary code execution on the victim's machine, resulting in full system compromise. Attackers can execute any code with the privileges of the user installing the package, potentially stealing secrets, keys, and other sensitive data. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee full remediation due to potential persistence mechanisms installed by the attacker.

There is no official patch or fix available for this malicious package. The recommended mitigation is to immediately remove the react-dynamic-table-compenent package version 1.2.7 from any affected systems. All secrets, keys, and credentials stored on compromised machines should be considered exposed and must be rotated from a secure, uncompromised environment. Due to the high risk of full system compromise, affected systems should be thoroughly inspected for additional malicious artifacts and potentially rebuilt if full trust cannot be restored.