@onereach/si-step-chooser@0.4.6

Analysis

The package's preinstall hook (setup.mjs) downloads a runtime binary and executes a bundled, heavily-obfuscated payload (math_init.js, ~727KB) at install time. The payload is obfuscated with a javascript-obfuscator-style _0x array and custom decode routine, hiding its behaviour from static inspection. The same bootstrap-and-obfuscated-payload pattern is used across the @onereach scope, whose sibling packages perform DNS-tunnel exfiltration, fetch-and-execute remote code, and evade sandbox analysis at install. Installing this package runs the obfuscated payload on the victim machine during npm install.