MalwarePublished 13 Jul 2026

react-markable-table (npm) · Malicious Code

Affects react-markable-tableSource GCVE Database

Malicious package : remove react-markable-table and rotate any secrets on hosts that installed it.

Data as of 14 Jul 2026, 09:55 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10446

What to do

Remove react-markable-table from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmreact-markable-table	Affected =2.4.10	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package react-markable-table version 2.4.10 is a typosquatting malicious package that executes attacker-controlled JavaScript code during installation. It contains a preinstall script that decodes and evaluates a payload fetched from a non-publisher controlled Vercel URL, leading to arbitrary code execution on the installer's machine. Any system with this package installed or running should be considered fully compromised, and all secrets and keys on that system should be rotated immediately. Removing the package does not guarantee removal of all malicious artifacts.

Impact

Installing react-markable-table@2.4.10 results in arbitrary attacker-controlled JavaScript execution on the victim's machine during installation. This can lead to full system compromise, including theft of secrets and keys. The compromise is severe enough that all credentials on the affected system should be considered exposed and rotated from a separate, trusted system. Removal of the package alone may not remove all malicious components introduced.

Defensive guidance

The primary mitigation is to avoid installing react-markable-table@2.4.10 and remove it immediately if found. Rotate all secrets and keys stored on affected machines from a different, uncompromised system. Treat any machine with this package installed as fully compromised and perform a thorough incident response and remediation.

Summary

react-markable-table@2.4.10 is a typosquat of the legitimate markdown-table package. Its package.json includes a preinstall hook that runs a script which base64-decodes an embedded payload. This payload performs an eval of JavaScript code fetched from a remote attacker-controlled Vercel endpoint. This results in arbitrary code execution on the machine at npm install time, effectively compromising the system. The malicious package masquerades as a legitimate package to trick users into installing it.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:55 UTC

Technical details

References

Community reviews