@onereach/or-file-uploader-next@0.0.10

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and executes a 727KB obfuscated payload file (math_init.js) with it at install time. The payload is encoded with a custom obfuscation scheme and contains eval/Function/child_process calls, and is unrelated to the package's declared purpose as a Vue file-uploader component. The package also declares dependencies on the known-malicious packages @onereach/styles and @onereach/ui-components. Installing this package runs an opaque, obfuscated payload on the victim's machine during npm install.