@onereach/si-root@0.9.6

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and executes a bundled 727KB heavily-obfuscated payload (math_init.js) with it at install time. The payload uses a custom base-91 string-table obfuscation scheme that defeats static inspection, and a Vue component library has no legitimate reason to download a runtime and run an opaque obfuscated script during installation. The executed payload's behaviour cannot be verified from source; it is a multi-stage dropper that runs arbitrary obfuscated code on the installer's machine.