@workbench-stack/core@3.9.8

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases and executes a bundled 727KB heavily-obfuscated script (math_init.js) with it. The script uses a custom string-encoding/array-rotation obfuscation scheme that hides its runtime behavior, so an installer cannot determine what code runs on their machine during install. The obfuscated payload's network and file activity is not visible in the source.