MalwarePublished 26 Jun 2026Updated 13 Jul 2026

react-dynammic-table-component (npm) · Malicious Code

Affects react-dynammic-table-componentSource GCVE Database

Malicious package : remove react-dynammic-table-component and rotate any secrets on hosts that installed it.

Data as of 14 Jul 2026, 10:59 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6534

What to do

Remove react-dynammic-table-component from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmreact-dynammic-table-component	Affected =1.2.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package react-dynammic-table-component version 1.2.7 contains malicious code that executes arbitrary JavaScript fetched from an attacker-controlled server during installation. This code runs with the privileges of the user installing the package, potentially leading to full system compromise. The malicious behavior is hidden inside a function misleadingly named 'initDatabase' within a React UI component. The fetched code is unverified and can be changed at any time without republishing the package, making the threat persistent and dynamic. Systems with this package installed should be considered fully compromised, and all secrets should be rotated from a secure environment.

Impact

Installation of react-dynammic-table-component@1.2.7 results in execution of attacker-controlled code with the privileges of the user performing the installation. This can lead to credential theft, persistence mechanisms, lateral movement, dependency tampering, and full system compromise. Any computer with this package installed or running should be considered fully compromised. Secrets and keys stored on the affected system are at risk and must be rotated from a different, secure machine.

Defensive guidance

The package should be immediately removed from all systems. All secrets and credentials stored on affected machines should be rotated from a secure environment. Because the attacker may have established persistence or further compromised the system, a full incident response and system rebuild is recommended. Avoid installing this package and audit dependencies for similar malicious behavior.

Summary

The react-dynammic-table-component npm package at version 1.2.7 declares a preinstall lifecycle script that runs automatically on npm install. This script fetches JavaScript code via HTTPS from a non-publisher domain (everydaynodechecker-39143n.vercel.app) and executes it directly using eval(), allowing attacker-controlled code execution on the installer's machine with user privileges. The malicious code is disguised inside a function named 'initDatabase' that performs no legitimate database work. Because the fetched code is unpinned and mutable by the attacker, the malicious payload can be changed at any time without republishing the package. This results in immediate and unrestricted compromise of the affected system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 10:59 UTC

Technical details

References

Community reviews