@onereach/content-builder-template-compiler@0.0.5

Analysis

The package runs a preinstall hook (node setup.mjs) that downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and then executes a bundled 727KB obfuscated script (math_init.js) during installation. The package's declared function is template compilation, which does not require downloading a runtime or executing a large obfuscated script at install time. The obfuscated script's behavior is not visible statically; the install-time download-and-execute of an unrelated obfuscated payload is the risk indicator.