@onereach/si-copyable-text@0.4.13

Analysis

@onereach/si-copyable-text@0.4.13, a Vue copyable-text UI component, ships a preinstall hook (`node setup.mjs`) that downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases and executes a bundled 727KB obfuscated payload (`math_init.js`) with it at install time. The payload uses a custom string-encoding obfuscation scheme that hides its behaviour from static analysis. A UI component has no legitimate need to download a runtime and run an opaque obfuscated script during installation; this is an install-time remote code-execution attack shape. The payload's network destinations could not be determined because the code is obfuscated.