@or-sdk/tables@0.28.7

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun runtime from github[.]com/oven-sh/bun and uses it to execute a bundled 727KB obfuscated script (math_init.js) at install time. The script is obfuscated with a custom string-array decoder and contains eval/Function/child_process usage. The package also depends on @or-sdk/base, a sibling package flagged as malicious. The obfuscated payload's network targets are not statically recoverable; the observable is a multi-stage install-time dropper that fetches a runtime and runs a large obfuscated payload during installation.