@ornikar/eslint-config-node@12.2.2

Analysis

The package @ornikar/eslint-config-node@12.2.2 is a trojanized version of a legitimate ESLint configuration package. The preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases, extracts it, and executes a 727KB obfuscated Bun-compiled blob (math_init.js) at install time. The package had been dormant for approximately 5 years before this version was published, indicating an account takeover of the original maintainer's npm credentials. The payload in math_init.js is heavily obfuscated and compiled for the Bun runtime, making its specific behaviour unreadable from static analysis alone, but the attack pattern is a remote code execution at install time via a compromised package.