Which versions of markdown-editable-table are malicious?

The following npm versions of markdown-editable-table are flagged malicious: 2.4.2, 2.4.3, 2.4.4. Treat any of these as compromised.

How do I remediate markdown-editable-table if I installed it?

markdown-editable-table is a typosquat — you almost certainly intended a legitimately-named package. Remove markdown-editable-table, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed markdown-editable-table — how do I know if it already compromised me?

If markdown-editable-table was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is markdown-editable-table part of a known attack campaign?

Yes — markdown-editable-table is associated with the IN-MAL-2026-010255, IN-MAL-2026-010256, IN-MAL-2026-010257 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find markdown-editable-table across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for markdown-editable-table (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging markdown-editable-table across your stack and pipelines.

Malicious package

markdown-editable-tablenpm

Malicious code in markdown-editable-table (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-10452

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall markdown-editable-table

What this malware does

The package's package.json declares a preinstall hook (node index.d.js) that runs automatically on npm install. The script in index.d.js base64-decodes a payload whose decoded body fetches JavaScript from https://everydaynodechecker-39143n.vercel.app/api/key?mem=root1 and passes the response to eval. Both the destination URL (hidden inside a base64 blob) and the eval identifier (reassembled from the char-code array [101,118,97,108] via String.fromCharCode and invoked as globalThis[tag](text)) are obfuscated. The package metadata (repository wooorm/markdown-table, description, funding) impersonates the legitimate markdown-table package while shipping unrelated code, indicating a typosquat lure. Installing the package results in arbitrary attacker-controlled JavaScript executing on the installer's machine.

Malicious versions

3 flagged

2.4.22.4.32.4.4

Indicators of compromise (SHA-256)

1af9c15e72bbf2919f740704b32ee6426447d5aade488dd65e2bffe4904afe9b

b6b15669732f3eaec42e12c5f8d41a8f74d595fc04f709804de9768cb1719a94

d477050087c5745224760506a048cc6467a7f33d987458e0bcbfdae6a1a94b92

Detection & response playbook

Typosquat

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for markdown-editable-table (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging markdown-editable-table across your stack and pipelines.
If you installed it — respond
markdown-editable-table is a typosquat — you almost certainly intended a legitimately-named package. Remove markdown-editable-table, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If markdown-editable-table was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks markdown-editable-table before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. markdown-editable-table on npm has been identified as a malicious package (versions 2.4.2, 2.4.3, 2.4.4 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-010255IN-MAL-2026-010256IN-MAL-2026-010257

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks markdown-editable-table-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring