The 'react-table-core' npm package (version 2.7.1) includes a malicious preinstall script disguised as a TypeScript declaration file ('index.d.js'). During 'npm install', this loader decrypts an AES-256-CBC ciphertext constructed from metadata fields in a configuration file using a hardcoded key and IV, then executes the decrypted code via eval. The use of obfuscation techniques such as splitting ciphertext across metadata fields, hiding the loader behind a '.d.js' extension, and reconstructing 'eval' from character codes indicates deliberate evasion. This package is a typosquatting attempt on the legitimate 'react-table' and '@tanstack/react-table' libraries, with mismatched README branding to mislead users. No patch or fix is currently documented.

Any system that installs 'react-table-core' version 2.7.1 is subject to arbitrary code execution by the attacker, potentially compromising the host environment. This can lead to full system compromise, data theft, or further malware deployment. The malicious code executes automatically during package installation, increasing risk to developers and CI/CD pipelines that fetch this package.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing 'react-table-core' version 2.7.1 and verify package authenticity before installation. Remove any installations of this package from projects and dependency trees. Use trusted package sources and consider implementing package integrity verification mechanisms such as checksums or signing. Monitor for and block typosquatting packages in your supply chain.