react-markable-table@2.4.10

Analysis

Combosquat of the legitimate markdown-table package. The preinstall hook (node index.d.js) base64-decodes a payload that fetches JavaScript from hxxps://everydaynodechecker-39143n[.]vercel[.]app/api/key?mem=root2 and executes it via eval, enabling arbitrary remote code execution at install time. The package ships a cloned copy of the real markdown-table source code (index.js) as camouflage.