@or-sdk/key-value-storage@0.28.8

Analysis

The preinstall hook (setup.mjs) downloads the Bun runtime from github[.]com/oven-sh/bun releases and executes a bundled 727KB obfuscated script (math_init.js) at install time. math_init.js is obfuscated with a custom string-array decoder and contains eval/Function/child_process calls, forming a multi-stage dropper that runs arbitrary code during npm install. The package also depends on @or-sdk/base and @or-sdk/sdk-api, which are separately flagged as malicious. The legitimate SDK code in dist/ is intact, but the install-time payload is obfuscated and executes on every install.