@onereach/si-switch@0.4.7

Analysis

The package's preinstall hook (setup.mjs) downloads a Bun runtime and executes a heavily-obfuscated 727KB JavaScript bundle (math_init.js) at install time on every machine that installs it. The obfuscated payload is unrelated to the package's declared function as a Vue switch UI component. The same preinstall hook and obfuscated-payload pattern is shared with the sibling package @onereach/webform@0.3.15, whose bundled code performs remote code fetch-and-execute, reads host identity (hostname/user/platform) alongside DNS resolution, and depends on the known-malicious @onereach/channel-transformer. Installing this package executes the obfuscated payload during npm install.