The npm package 'markdown-editable-table' versions 2.4.2, 2.4.3, and 2.4.4 contains malicious code that executes arbitrary JavaScript during installation via a preinstall hook. This code fetches and evaluates attacker-controlled scripts from a remote URL, effectively compromising the host machine. The package impersonates the legitimate 'markdown-table' package as a typosquat lure. Systems with this package installed should be considered fully compromised, and secrets should be rotated immediately.