@or-sdk/library-types-v2@9.0.3

Analysis

@or-sdk/library-types-v2@9.0.3, a package that otherwise ships only TypeScript type definitions, declares a preinstall hook (node setup.mjs) that downloads the Bun JavaScript runtime from the official oven-sh/bun GitHub release and then executes a bundled 727KB file (math_init.js) with it. math_init.js is a fully obfuscated payload encoded with a custom base-N alphabet decoder; its logic, network destinations, and any data it collects are not readable from the source. A package whose stated purpose is pure type definitions has no legitimate reason to download a runtime and execute an opaque 727KB payload at install time. The payload's behaviour and any C2 endpoints are concealed by the encoding and could not be recovered from static analysis.