Threats Tagged 'mal-2026-10444'

The npm package 'markable-table' versions 3.1.0 through 3.1.8 contains malicious code that executes arbitrary JavaScript fetched from a remote server during installation. This is achieved by obfuscated code that hides the use of 'eval' to run the fetched payload, enabling remote code execution on any machine running 'npm install' for this package. The package is a typosquat of the legitimate 'markdown-table' package and its behavior is inconsistent with its advertised purpose. Systems with this package installed should be considered fully compromised.