@or-sdk/knowledge-models@0.25.7

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun runtime from github[.]com/oven-sh/bun releases and uses it to execute a bundled 727KB obfuscated script (math_init.js) at install time. The script is obfuscated with a large encoded string array and a custom decoder, and contains eval/Function/child_process references. The package also depends on @or-sdk/base, a known-malicious package. Installing this package runs the obfuscated payload on the victim's machine during npm install.