@or-sdk/library@0.5.8
Malicious code in @or-sdk/library (npm)
T1059.007 · JavaScriptT1027.002 · Software PackingT1105 · Ingress Tool Transfer
Analysis
The package's preinstall hook (setup.mjs) downloads the Bun runtime from github[.]com/oven-sh/bun/releases/download/bun-v1.3.13 and uses it to execute a bundled 727KB obfuscated script (math_init.js). The script is obfuscated with a large encoded string array and a custom decoder, and its behaviour is not readable from the source. The package also declares dependencies on sibling packages (@or-sdk/base, @or-sdk/library-types-v1, @or-sdk/library-types-v2) that are known-malicious. Installing this package runs the obfuscated payload at install time.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 11:58 AM
- analyzed
- Aug 4, 2026, 05:15 PM
- weekly installs
- 205
Related advisories
- @or-sdk/base@0.44.6
- @or-sdk/sdk-api@0.29.4
- @or-sdk/providers@0.3.8
- @servicetitan/mfe-quick-actions@0.5.53
- @ornikar/rollup-plugin-postcss@2.0.10
- @ornikar/eslint-config-babel-use@13.2.4
- assertion-utils-js@2.4.3
- boardflow@1.1.4
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.