@ornikar/eslint-config-typescript-nestjs@24.0.1

Analysis

The package @ornikar/eslint-config-typescript-nestjs@24.0.1 is a trojanized version of a legitimate ESLint configuration package. Version 24.0.1 introduces a preinstall hook (setup.mjs) that downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases/ and executes a 728KB heavily obfuscated script (math_init.js) through it. The obfuscated script uses custom encoding and function-constructor/eval patterns that prevent static analysis of its true behaviour. An ESLint config package has no legitimate reason to download a JavaScript runtime and run obfuscated code on install. The payload's behaviour cannot be determined from static analysis alone due to the obfuscation.