@onereach/si-radio-group@0.3.7

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun runtime and executes a 727KB heavily-obfuscated script (math_init.js) at install time. The script uses a custom string-encoding obfuscation scheme to hide its behaviour. The package is a dormant UI component (last released 2021) republished with this install-time payload. The same publisher's sibling package in the same scope depends on a known-malicious package and exhibits remote-code-execution and DNS-recon behaviour, indicating this is part of a coordinated malicious republish campaign. Installing this package runs an opaque, obfuscated payload on the installer's machine.