@or-sdk/agents@4.21.5

Analysis

The package's preinstall hook (setup.mjs) runs on install: it detects the platform/architecture, downloads the Bun JavaScript runtime from the oven-sh GitHub releases, and uses it to execute a bundled 727KB obfuscated script (math_init.js). The script is obfuscated with a large encoded string array and a custom base-N decoder, and contains eval, Function-constructor, and child_process calls, indicating it executes dynamically-decoded code. The package also depends on three sibling packages (@or-sdk/base, @or-sdk/bots, @or-sdk/deployer) that are known-malicious. The exact command-and-control endpoints are encoded inside the obfuscated payload and are not visible in the plaintext source.