@onereach/postcss-scoped-selector@1.2.3

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from the official oven-sh/bun GitHub releases and executes a bundled 727KB script (math_init.js) with it. math_init.js is obfuscated with a custom string-encoding scheme that hides all of its strings, URLs, and API calls, so its behaviour is not statically readable. A PostCSS selector-scoping plugin has no legitimate need to download a runtime and run an opaque obfuscated payload at install time. No network destination or exfil endpoint could be extracted from the encoded payload.