@or-sdk/source-api@1.1.3
Malicious code in @or-sdk/source-api (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool Transfer
Analysis
The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and executes a 727KB heavily-obfuscated script (math_init.js) during installation. The obfuscated payload's behavior is opaque and cannot be statically verified; it runs on every install regardless of whether the package is used. No additional network endpoints or credential access were readable in the obfuscated payload.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 11:58 AM
- analyzed
- Aug 4, 2026, 03:04 PM
Related advisories
- @or-sdk/base@0.44.6
- @or-sdk/sdk-api@0.29.4
- @or-sdk/providers@0.3.8
- @onereach/or-file-uploader-next@0.0.10
- @servicetitan/line-item-editor@1.5.4
- @onereach/slack-helpers@1.0.5
- @onereach/types-contacts-api@9.0.10
- @onereach/or-sdk-agent-cli@0.0.8
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.