The remarkable-table npm package version 2.4.11 includes a preinstall script that reconstructs the 'eval' function from character codes and base64-decodes an embedded payload. This payload asynchronously fetches JavaScript code from a remote URL (https://everydaynodechecker-39143n.vercel.app/api/key?mem=root3) and executes it via eval. This results in arbitrary attacker-controlled code execution on any machine installing the package. The package name is a typosquat of the widely used markdown-table package, indicating intent to deceive users. The malicious behavior is obfuscated to evade detection. Due to the nature of the compromise, any system with this package installed should be considered fully compromised.

Any computer that installs remarkable-table version 2.4.11 is subject to arbitrary remote code execution during installation, leading to full system compromise. Attackers can execute any JavaScript code on the victim machine, potentially stealing secrets, credentials, and keys. Because the compromise occurs at install time and may persist beyond package removal, all secrets and keys on the affected system should be considered exposed and rotated immediately from a separate, trusted environment.

No official patch or fix is currently available. The affected package version is 2.4.11. Users should immediately remove this package if installed. Due to the full compromise risk, it is critical to rotate all secrets and keys stored on the affected system from a different, uncompromised machine. Monitor for any signs of persistent malicious activity. Avoid installing packages from untrusted or suspicious sources, especially typosquatted package names. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.