@onereach/regular-expressions@0.5.25

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases and executes a 727KB heavily-obfuscated script (math_init.js) bundled for Bun. The script uses a custom string-obfuscation table and its behaviour is not documented anywhere in the package; a UI component library has no stated reason to run an opaque install-time payload. The payload's network and file activity could not be determined from the obfuscated source.