@onereach/v-event-calendar@0.1.24
Malicious code in @onereach/v-event-calendar (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool TransferT1027 · Obfuscated Files or Information
Analysis
The package's preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime and then executes a bundled 727KB heavily-obfuscated file (math_init.js) containing a custom string decoder, eval/Function calls, and child_process usage. A Vue event-calendar plugin has no legitimate reason to download a runtime and run an obfuscated payload at install time. The same setup.mjs + math_init.js payload is shipped in @onereach/webform@0.3.15.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 01:03 PM
- analyzed
- Aug 4, 2026, 03:12 PM
Related advisories
- @onereach/ui-components@27.0.4
- @onereach/ui-components-vue2@27.0.4
- @onereach/expression-components@9.1.3
- @or-sdk/bot-templates@2.2.7
- @or-sdk/qna@3.4.4
- @onereach/orest-input-cli@1.18.3
- @onereach/or-browser-next@0.0.13
- @onereach/or-file-uploader-next@0.0.10
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.