@onereach/si-dropdown-simple@0.4.7
Malicious code in @onereach/si-dropdown-simple (npm)
Analysis
Version 0.4.7 of the @onereach/si-dropdown-simple Vue component adds a preinstall hook (setup.mjs) that downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases and executes a bundled 727KB obfuscated payload (math_init.js) with it. The payload is obfuscated with the javascript-obfuscator tool (a large _0x dictionary array plus a custom base64 decoder) and contains eval, Function, and child_process usage, hiding its actual behavior. The package's declared component code is a normal Vue dropdown with no legitimate need to download a runtime or run an obfuscated script at install time.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 12:38 PM
- analyzed
- Aug 4, 2026, 02:04 PM
Related advisories
- @onereach/ui-components@27.0.4
- @onereach/ui-components-vue2@27.0.4
- @onereach/expression-components@9.1.3
- @onereach/si-divider@0.4.13
- @onereach/si-a-button@0.0.5
- @onereach/channel-transformers@0.0.7
- @onereach/bandwidth-steps-voice-bxml@0.1.3
- @onereach/si-dropdown-advanced@0.4.7
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.