@ornikar/eslint-config-babel-use@13.2.4

Analysis

@ornikar/eslint-config-babel-use@13.2.4 is a trojanized eslint config package. The preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/ and executes a heavily obfuscated 727KB Bun-compiled script (math_init.js) with it. The package depends on @ornikar/eslint-config which is a known-malicious package, confirming the @ornikar npm org was compromised. The obfuscated payload's exact behaviour cannot be determined statically, but the preinstall hook + remote binary download + obfuscated script execution is a supply-chain attack pattern.