@or-sdk/api-tokens@1.4.4

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun runtime from github[.]com/oven-sh/bun and uses it to execute a bundled 727KB obfuscated script (math_init.js). The script is obfuscated with a large encoded string array and a custom decoder, and its behaviour is unrelated to the package's declared purpose of managing API tokens. The package also depends on @or-sdk/base, which is a known-malicious package. Installing this package executes the obfuscated payload at install time.