@onereach/regex-helper@0.5.18

Analysis

The preinstall hook (node setup.mjs) of this deprecated Vue regex component downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and executes a bundled 727KB obfuscated script (math_init.js) with it at install time. The script uses a custom string-encoding obfuscation scheme that hides its runtime behaviour; a Vue regex helper has no legitimate need to fetch a runtime and run an opaque obfuscated payload during installation. The payload's network and data-access behaviour cannot be determined from the obfuscated source.