The npm package 'react-table-core' version 2.7.1 contains malicious code that executes arbitrary attacker-controlled commands on any machine that installs it. The package disguises an executable loader as a TypeScript declaration file and decrypts hidden ciphertext at install time, passing the decrypted code to eval. This package is a typosquatting attempt targeting the popular 'react-table' libraries, using misleading README content to lure users. There is no official patch or remediation information available.