@onereach/ui-components-vue2@27.0.4

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from the oven-sh/bun GitHub release URL and uses it to execute a bundled 727KB heavily-obfuscated payload (math_init.js) at install time. The payload uses a large encoded string-array with a custom decoder (javascript-obfuscator shape). A Vue components library has no legitimate reason to download a runtime and run an obfuscated 727KB script during installation; the obfuscated payload's network behaviour is not statically recoverable but the install-time runtime-download-and-execute staging is the malicious behaviour.