@or-sdk/library-source@0.4.7

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and uses it to execute a bundled 727KB obfuscated script (math_init.js) at install time. math_init.js is a single-line obfuscated payload built with a custom string-array decoder and constant table, and contains eval/Function/child_process usage, so its full behaviour is hidden behind the obfuscation. The package also depends on the @or-sdk/base and @or-sdk/library-types-v1 packages. Installing this package runs the obfuscated payload automatically via the preinstall lifecycle hook.