@onereach/step-components@0.1.39

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases and then executes a 727KB heavily-obfuscated script (math_init.js) at install time. The script uses a custom encoding with a rotated string table and contains dynamic code evaluation (eval/Function) and child-process execution calls, with its behaviour concealed by the obfuscation. A UI component library has no legitimate need to run an obfuscated payload during installation. No network destination was observed because the payload failed to execute in the analysis sandbox; the analysis is static-only and no C2 host could be extracted.