@onereach/orest-jest-presets@0.0.5

Analysis

The package's preinstall hook (node setup.mjs) downloads the bun JavaScript runtime from github[.]com/oven-sh/bun and executes a 727KB heavily-obfuscated payload file (math_init.js) at install time. The payload is a single-line custom-obfuscated blob (custom base64-alphabet decoder) whose behavior is not statically readable. The package is a Jest configuration preset, which has no legitimate reason to download a runtime and run a large obfuscated executable during installation. The payload's network/credential behavior could not be determined statically because it is fully encoded.