@or-sdk/adapters@0.3.8

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun runtime from github[.]com/oven-sh/bun/releases and uses it to execute a bundled 727KB obfuscated script (math_init.js) at install time. The script is obfuscated with a large encoded string array and a custom decoder (javascript-obfuscator signature) and contains eval, Function, and child_process usage, concealing its behavior. The package also depends on other packages that are known-malicious. No network C2 endpoint could be extracted from the obfuscated payload.