@onereach/ui-components@27.0.4
Malicious code in @onereach/ui-components (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool TransferT1059 · Command and Scripting Interpreter
Analysis
The package's preinstall hook (node setup.mjs) downloads the Bun runtime from github[.]com/oven-sh/bun/releases/download/bun-v1.3.13 and uses it to execute a bundled 727KB obfuscated script (math_init.js). The script is obfuscated with a large encoded string array and a custom decoder, and runs at install time on every machine that installs the package. A Vue UI components library has no legitimate reason to download a runtime and execute a large obfuscated payload during installation.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 11:58 AM
- analyzed
- Aug 4, 2026, 05:49 PM
- weekly installs
- 6,050
Related advisories
- @onereach/ui-components-vue2@27.0.4
- @onereach/expression-components@9.1.3
- @onereach/rwc-client@6.4.9
- @onereach/si-datepicker@0.4.7
- @servicetitan/anvil-react@0.11.7
- @ornikar/eslint-config-typescript-nestjs@24.0.1
- @ornikar/eslint-config-typescript-react@24.0.1
- tailwind-anime@1.1.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.