@onereach/si-divider@0.4.13

Analysis

The package is a Vue.js UI divider component whose published tarball was trojanized: its preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun releases and then executes a 727KB heavily-obfuscated payload file (math_init.js) with it. The payload is a single-line custom base-N alphabet-decoder blob (javascript-obfuscator style) that hides its actual behaviour; the component itself has no legitimate need to download a runtime or run an obfuscated payload at install time. The install hook runs automatically on npm install.