@ornikar/react-native-svg-transformer@1.0.10

Analysis

@ornikar/react-native-svg-transformer@1.0.10 is a trojanized clone of the legitimate react-native-svg-transformer package. It preserves the real package's code as cover but adds a preinstall hook (setup.mjs) that downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/ and executes a 727KB heavily-obfuscated payload file (math_init.js) through it. The payload contains eval, Function constructor, and child_process calls with a custom string decoder, making its full behaviour opaque without runtime analysis. The package has no repository and no documented purpose for downloading and executing a separate runtime at install time.