@onereach/channel-transformer@0.0.68

Analysis

@onereach/channel-transformer@0.0.68 ships a preinstall hook (setup.mjs) that downloads the bun JavaScript runtime from github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/ and executes a 727KB heavily-obfuscated payload file (math_init.js) at install time. The payload is a bun-compiled bundle with all strings encoded via a custom obfuscator, so its exact exfiltration/C2 behavior cannot be statically extracted; the install-time execution of an obfuscated payload unrelated to the library's stated purpose (channel data-model conversion) is the malicious behavior. The library's normal dist/ bundles are unchanged; the malicious preinstall hook and payload were added to this version.