[email protected] is a typosquat of the legitimate markdown-table package. Its package.json includes a preinstall hook that runs a script which base64-decodes an embedded payload. This payload performs an eval of JavaScript code fetched from a remote attacker-controlled Vercel endpoint. This results in arbitrary code execution on the machine at npm install time, effectively compromising the system. The malicious package masquerades as a legitimate package to trick users into installing it.

Installing [email protected] results in arbitrary attacker-controlled JavaScript execution on the victim's machine during installation. This can lead to full system compromise, including theft of secrets and keys. The compromise is severe enough that all credentials on the affected system should be considered exposed and rotated from a separate, trusted system. Removal of the package alone may not remove all malicious components introduced.

No official patch or fix is available for this malicious package. The primary mitigation is to avoid installing [email protected] and remove it immediately if found. Rotate all secrets and keys stored on affected machines from a different, uncompromised system. Treat any machine with this package installed as fully compromised and perform a thorough incident response and remediation.