@onereach/si-select@0.1.5
Malicious code in @onereach/si-select (npm)
Analysis
The package's preinstall hook (node setup.mjs) runs at install time: it downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases (bun-v1.3.13) and executes a bundled 727KB heavily-obfuscated script (math_init.js) with that runtime. The obfuscated payload's behavior could not be determined from static inspection; no exfiltration endpoints or credential reads were observed in plaintext. Installing this package executes an opaque, obfuscated payload via a downloaded runtime, unrelated to the package's stated purpose as a UI select component.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 12:16 PM
- analyzed
- Aug 4, 2026, 01:38 PM
Related advisories
- @onereach/ui-components@27.0.4
- @onereach/ui-components-vue2@27.0.4
- @onereach/expression-components@9.1.3
- @onereach/si-validated-timestring-input@0.3.7
- umadev@1.0.74
- @onereach/orest-jest-presets@0.0.5
- @onereach/step-components@0.1.39
- @onereach/regular-expressions-test@0.0.6
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.