@onereach/si-textinput@0.5.7

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and executes a 727KB script (math_init.js) at install time. math_init.js is obfuscated with a custom string-encoding scheme that hides all of its API calls, so its runtime behavior cannot be determined statically. A Vue text-input component has no legitimate need to download a runtime and run a large obfuscated payload during installation; the obfuscated install-time code is the malicious behavior.