@onereach/orest-vue-demi-vue2@0.0.6

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases and executes a 727KB obfuscated payload (math_init.js) with it during installation. The package otherwise only re-exports VueDemi globals, so the install-time download-and-execute of an opaque obfuscated blob serves no legitimate purpose. The payload is encoded with a custom string-array decoder; its network/behavioural intent is not visible in plaintext.