@or-sdk/data-hub-svc@2.3.7

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun runtime from github[.]com/oven-sh/bun releases and uses it to execute a bundled 727KB obfuscated script (math_init.js). The script is obfuscated with a large encoded string array and a custom decoder, and contains eval/Function-constructor and child_process calls. The package also declares a dependency on @or-sdk/base, a package previously identified as malicious. Installing this package runs the obfuscated payload at install time.