@onereach/si-collapsible-group@0.6.6

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and executes a bundled 727KB heavily-obfuscated payload (math_init.js) with it. The payload is obfuscated with a custom string-encoding scheme and _0x identifier renaming, making its behaviour opaque. A Vue component library has no legitimate reason to download a runtime and run an obfuscated script at install time; this is an install-time downloader-and-execute pattern consistent with a compromised package.