@onereach/si-validated-timestring-input@0.3.7
Malicious code in @onereach/si-validated-timestring-input (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool Transfer
Analysis
The package's preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases and executes a bundled, heavily obfuscated script (math_init.js) at install time. The obfuscated payload runs during installation via the downloaded runtime; its behaviour could not be determined from static inspection. No network endpoints or credential theft were confirmed.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 12:31 PM
- analyzed
- Aug 4, 2026, 01:38 PM
Related advisories
- @onereach/ui-components@27.0.4
- @onereach/ui-components-vue2@27.0.4
- @onereach/expression-components@9.1.3
- umadev@1.0.74
- @onereach/orest-jest-presets@0.0.5
- @onereach/step-components@0.1.39
- @onereach/regular-expressions-test@0.0.6
- @thiennq/docs-viewer@1.6.3
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.