The remarkable-table npm package version 2.4.11 contains malicious code in its preinstall script that executes attacker-controlled JavaScript during installation. This script reconstructs and uses eval to run code fetched from a remote server, leading to arbitrary code execution on the installer's machine. The package is a typosquat of the legitimate markdown-table package. Installing this package compromises the host system, potentially exposing all stored secrets and keys. Removal of the package does not guarantee full remediation due to possible persistent compromise.