@or-sdk/sdk-api@0.29.4

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun runtime and uses it to execute a 727KB obfuscated script bundled as math_init.js. The script is obfuscated with a large encoded string array and a custom decoder (javascript-obfuscator signature) and contains eval/Function-constructor and child_process calls, so its runtime behaviour is concealed. The package also depends on @or-sdk/base, which is itself flagged as malicious. Installing this package executes the obfuscated payload at install time.