@onereach/orest-vue-demi-vue3@0.0.6

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and executes a 727KB obfuscated script (math_init.js) during installation. The obfuscated payload uses string-array encoding, so its runtime behavior is not readable from source. The package is a vue-demi re-export shim with no legitimate need to download a runtime and run a large obfuscated script at install time. No external C2 endpoint was observed in the readable portions of the package; the only network destination is the canonical Bun release download.