@or-sdk/hitl@0.41.2

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases and executes a bundled 727KB obfuscated script (math_init.js) at install time. The obfuscated payload is encoded with a custom alphabet and is not readable; its behaviour is opaque. The package already ships normal compiled builds (dist/cjs, dist/esm, dist/types) that constitute the SDK, so the install-time runtime download and opaque payload execution is separate from the SDK's documented function and is not described in the README or changelog. Installing this package runs the obfuscated payload on the installer's machine.