@onereach/step-conversation@1.0.43
Malicious code in @onereach/step-conversation (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool Transfer
Analysis
The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and executes a 727KB heavily-obfuscated JavaScript payload (math_init.js) at install time. The payload uses javascript-obfuscator-style string encoding, eval and Function constructors, and child_process, so its behaviour cannot be determined from static inspection. The package's actual library code is a plain conversation-step class with no legitimate need to bootstrap a runtime or run obfuscated code during installation.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 01:31 PM
- analyzed
- Aug 4, 2026, 02:29 PM
- weekly installs
- 218
Related advisories
- @onereach/ui-components@27.0.4
- @onereach/ui-components-vue2@27.0.4
- @onereach/expression-components@9.1.3
- @or-sdk/library-types-v2@9.0.3
- @servicetitan/startup-mfe-compat@0.5.3
- @or-sdk/hitl@0.41.2
- @servicetitan/carto-charts-core@0.0.6
- @onereach/step-run-snowflake-query@0.1.3
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.