@onereach/si-checkbox-group@0.3.7

Analysis

A dormant Vue component package was republished with a preinstall hook (node setup.mjs) that downloads the Bun JavaScript runtime and then executes a 727KB heavily-obfuscated payload (math_init.js) bundled in the package. The payload uses a bespoke obfuscation scheme (a base64-alphabet decoder over a large string table) and its behaviour cannot be statically verified; the package's own lib/ bundles are legitimate Vue/vuelidate/lodash code, so the obfuscated payload is the only executed code of concern. Installing this package runs the obfuscated payload at install time.