@onereach/webform@0.3.15

Analysis

The package's preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime and executes a bundled 727KB heavily-obfuscated file (math_init.js) containing a custom string decoder, eval/Function calls, and child_process usage. The main bundle (dist/lib/oneReachWebForm.min.js) additionally decodes a base64-array payload, fetches remote content and executes it, reads host identity alongside DNS lookups, and delays execution. A webform UI library has no legitimate reason to download a runtime and run an obfuscated payload at install time. The same setup.mjs + math_init.js payload is shipped in @onereach/v-event-calendar@0.1.24.