@onereach/si-datepicker@0.4.7

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun runtime and executes a 727KB obfuscated payload (math_init.js) that is unreadable without deobfuscation. The same bootstrap is used across the @onereach package family, whose runtime behaviour includes DNS beaconing, host-identity fingerprinting, and fetching and executing remote code. Installing this package runs the obfuscated payload at install time.