@onereach/si-checkbox@0.6.7

Analysis

@onereach/si-checkbox@0.6.7, a Vue checkbox UI component, ships a preinstall hook (node setup.mjs) that downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and executes a 727KB obfuscated payload (math_init.js) at install time. The payload is heavily obfuscated with a custom base64-style decoder, a large constant array, and eval/Function/child_process usage. A UI checkbox component has no legitimate reason to download a runtime and run an obfuscated payload during installation. The same @onereach namespace also published @onereach/webform@0.3.15 with a matching install-time payload that performs remote fetch-to-exec and DNS beaconing.