@onereach/phonenumber-interpreter@0.0.20
Malicious code in @onereach/phonenumber-interpreter (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool TransferT1027 · Obfuscated Files or Information
Analysis
The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime and uses it to execute a 727KB heavily-obfuscated file (math_init.js) at install time. The obfuscated payload uses a custom string-encoding scheme that hides its behavior from static analysis. The package is presented as a libphonenumber wrapper, but the obfuscated install-time payload is unrelated to phone-number parsing. The legitimate libphonenumber code ships separately in lib/index.js; math_init.js is an injected payload executed during installation.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 12:18 PM
- analyzed
- Aug 4, 2026, 02:36 PM
Related advisories
- @onereach/ui-components@27.0.4
- @onereach/ui-components-vue2@27.0.4
- @onereach/expression-components@9.1.3
- @or-sdk/library-types-v1@9.0.3
- @onereach/orest-vue-demi-vue3@0.0.6
- @onereach/si-root@0.9.6
- @servicetitan/startup-mfe-compat@0.5.3
- @servicetitan/carto-charts-core@0.0.6
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.