@or-sdk/invitations@1.4.10

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun runtime from github[.]com/oven-sh/bun/releases and uses it to execute a bundled 727KB obfuscated script (math_init.js). The script is obfuscated with a large encoded string array and a custom decoder, and contains eval/Function/child_process calls, forming a multi-stage dropper that runs arbitrary code at install time. The package also depends on the sibling package @or-sdk/users. The legitimate SDK source is present but the injected install-time payload is not part of the documented SDK behaviour.