@or-sdk/apps@1.2.8

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun runtime from github[.]com/oven-sh/bun releases and uses it to execute a bundled 727KB script (math_init.js). That script is obfuscated with a large encoded string array and a custom decoder, concealing its behaviour. The package also depends on @or-sdk/base and @or-sdk/providers, which are flagged as malicious. The install-time execution of a large obfuscated payload via a downloaded runtime is a multi-stage dropper pattern; the payload's network behaviour is concealed inside the obfuscation.