@onereach/idw-apps@0.1.5

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun runtime from github[.]com/oven-sh/bun/releases and executes a 727KB obfuscated JavaScript payload (math_init.js) at install time. The payload uses a custom base64-style string decoder and invokes eval/Function and child_process. The package's documented purpose is an MCP Apps adapter and its shipped dist/ code is a thin wrapper over @modelcontextprotocol/ext-apps; the install-time execution of the obfuscated math_init.js payload is undocumented and unrelated to that purpose. The payload's behaviour could not be statically determined due to obfuscation.