The npm package table-ui-new versions 2.7.2 and 2.7.5 ship a dist/config.js module that exports an array named HASHES containing four base64-encoded strings. Each string decodes to an immediately-invoked async function expression that fetches JavaScript code from a hardcoded external URL (https://everydaynodechecker-39147n.vercel.app/api/key?mem=root[0-3]) and evaluates it via eval(). This results in unconditional remote code execution in the consumer's Node.js process with full host privileges. The malicious payload is disguised as inert data and is exposed through a public subpath export, posing a severe risk to any project importing this module. The main entry point does not invoke these payloads, but the presence of this export enables exploitation.

Any consumer of the table-ui-new package that imports the './config' subpath will receive an array of executable payloads that fetch and run attacker-controlled JavaScript code with full privileges in the Node.js environment. This allows remote code execution, potentially leading to full system compromise, data theft, or further malicious activity. The malicious code is unrelated to the package's intended functionality and is hidden behind a misleading variable name, increasing the risk of unnoticed exploitation.

No official patch or remediation is currently documented. Consumers should avoid importing the './config' subpath from table-ui-new versions 2.7.2 and 2.7.5. It is recommended to audit dependencies for this package and remove or replace it until a trusted, clean version is available. Monitor vendor advisories or npm security notices for updates or official fixes. Since the package is not a cloud service, remediation depends on user action.