The react-dynammic-table-component npm package at version 1.2.7 declares a preinstall lifecycle script that runs automatically on npm install. This script fetches JavaScript code via HTTPS from a non-publisher domain (everydaynodechecker-39143n.vercel.app) and executes it directly using eval(), allowing attacker-controlled code execution on the installer's machine with user privileges. The malicious code is disguised inside a function named 'initDatabase' that performs no legitimate database work. Because the fetched code is unpinned and mutable by the attacker, the malicious payload can be changed at any time without republishing the package. This results in immediate and unrestricted compromise of the affected system.

Installation of [email protected] results in execution of attacker-controlled code with the privileges of the user performing the installation. This can lead to credential theft, persistence mechanisms, lateral movement, dependency tampering, and full system compromise. Any computer with this package installed or running should be considered fully compromised. Secrets and keys stored on the affected system are at risk and must be rotated from a different, secure machine.

No official patch or fix is currently available for this malicious package version. The package should be immediately removed from all systems. All secrets and credentials stored on affected machines should be rotated from a secure environment. Because the attacker may have established persistence or further compromised the system, a full incident response and system rebuild is recommended. Avoid installing this package and audit dependencies for similar malicious behavior.