@ornikar/apollo-link-timeout@1.4.3
Malicious code in @ornikar/apollo-link-timeout (npm)
Analysis
The package @ornikar/apollo-link-timeout@1.4.3 is a trojanized version of the legitimate apollo-link-timeout library. The package.json declares a preinstall hook (node setup.mjs) that downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/ (platform-specific zip) and executes a heavily obfuscated 727KB bundle (math_init.js) through the downloaded runtime. The legitimate library has no preinstall hook and no Bun dependency. The obfuscated payload's behaviour cannot be determined from static analysis alone, but the pattern of downloading a runtime and executing obfuscated code at install time is a supply-chain attack vector.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 10:39 AM
- analyzed
- Aug 4, 2026, 11:11 AM
Related advisories
- @ornikar/prismic-components@0.0.8
- @ornikar/rollup-plugin-postcss@2.0.10
- @ornikar/react-native-svg-transformer@1.0.10
- @onereach/ts-memoize@1.0.2
- @ornikar/eslint-config-typescript-nestjs@24.0.1
- @ornikar/eslint-config-typescript-react@24.0.1
- bigops-create-manifest@35.2.4
- bigops-cobrowsing-client@35.1.9
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.