@onereach/regular-expressions-test@0.0.6
Malicious code in @onereach/regular-expressions-test (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool Transfer
Analysis
The package's preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and then executes a 727KB heavily-obfuscated script (math_init.js) bundled in the package. The payload is obfuscated with a string-rotation/decoder scheme that conceals its behaviour, and it is unrelated to the package's declared purpose as a regular-expression UI component library. Installing the package runs this opaque payload at install time.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 01:03 PM
- analyzed
- Aug 4, 2026, 01:32 PM
Related advisories
- @onereach/ui-components@27.0.4
- @onereach/ui-components-vue2@27.0.4
- @onereach/expression-components@9.1.3
- @thiennq/docs-viewer@1.6.3
- @onereach/idw-contracts@0.1.4
- @onereach/time-interpreter@1.0.32
- verdaccio-okta-oauth@38.1.12
- @servicetitan/carto-react-kit@0.8.8
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.