@or-sdk/content-request@0.2.8

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun runtime and uses it to execute a bundled 727KB obfuscated script (math_init.js). The script is obfuscated with a large encoded string array and a custom decoder, concealing its behavior. The package's actual library code is a trivial HTTP wrapper of a few hundred bytes, so the install-time execution of the large obfuscated payload serves no legitimate purpose for the declared functionality. The package also depends on sibling packages (@or-sdk/base, @or-sdk/providers) that are independently known to be malicious.