@onereach/orest-input-cli@1.18.3

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime and executes a 727KB heavily-obfuscated script (math_init.js) at install time. The obfuscated payload uses the javascript-obfuscator pattern (large constant array plus string-decoder) and is unrelated to the CLI's declared function. The package also depends on the known-malicious package @or-sdk/store, which it imports in lib/api/storeApi.js. Installing this package runs the obfuscated payload on the victim's machine.