@onereach/idw-contracts@0.1.4

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and executes a 727KB heavily-obfuscated bundled script (math_init.js) at install time. A shared contracts/schemas/types library has no legitimate reason to download a runtime and run an opaque obfuscated payload during installation. The obfuscated payload's behaviour is concealed behind javascript-obfuscator-style identifier renaming and a custom string-encoding table, so its network/collection actions cannot be read statically. The same install-time bootstrap pattern is used by the publisher's @onereach/webform package, which fetches remote content and executes it and beacons via DNS TXT queries.