@or-sdk/chat@0.3.3

Analysis

@or-sdk/chat@0.3.3, a chat-widget SDK, ships a preinstall hook (node setup.mjs) that downloads the Bun JavaScript runtime and then executes a bundled 727KB heavily-obfuscated script (math_init.js) at install time. The script uses a custom string-encoding scheme so its logic is opaque to inspection; the package's own source (dist/) is a plain chat helper with no lifecycle hook, and the changelog documents no such install behaviour. Installing this version runs an obfuscated payload on the machine with network access. The payload's exact actions could not be determined statically due to the obfuscation.