@onereach/time-interpreter@1.0.32

Analysis

The preinstall hook (setup.mjs) downloads the Bun JavaScript runtime binary from github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/ for the target platform, then executes a heavily obfuscated 728KB script (math_init.js) through the downloaded Bun binary. The obfuscated script uses javascript-obfuscator style encoding with a large encoded string array and custom decoder function. The package's main entry point (index.js) is a legitimate time-conversion library using moment-timezone, but the preinstall behaviour is unrelated to the package's stated purpose and is a supply-chain attack pattern. The Bun download failed during analysis so the obfuscated payload's full behaviour could not be observed at runtime.