@onereach/si-text-message@0.4.7

Analysis

@onereach/si-text-message@0.4.7 is a trojanized re-publish of a legitimate Vue component library. The package.json preinstall hook runs setup.mjs, which downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and executes a bundled 727KB obfuscated payload (math_init.js) with it at install time. The payload is fully obfuscated with a custom string-encoding scheme, so its behaviour is hidden; the install hook fetches and runs arbitrary code on the installer's machine. The original component code under lib/ is unchanged — only the preinstall hook and the obfuscated payload were injected.