Hostile 100% javascript Download

react-tabulix-ui 0.1.0

preinstall executes remote code

Encoded async loader fetch-evals remote codeEncoded fetch-eval via Vercel serverless app
SHA-256cc2abcae12371f0509995d0b2b6b6450b13e4b5eaab8bd7d96184bb7ae830455
URLhttps://registry.npmjs.org/react-tabulix-ui/-/react-tabulix-ui-0.1.0.tgz
MaleculeO₂(CS₃)H₅(Cm₄Db₆OsPoU)Md₂(Pa₆)

Also flagged by osv (MAL-2026-10988: Malicious code in react-tabulix-ui (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.