@or-sdk/bot-templates@2.2.7

Analysis

The package runs a preinstall hook (node setup.mjs) that downloads the Bun runtime and executes a bundled 727KB obfuscated JavaScript payload (math_init.js) at install time. The payload is protected by a custom string-array obfuscation scheme, making its behaviour opaque to inspection. The package also declares dependencies on @or-sdk/base and @or-sdk/data-hub-svc, which are part of the same malicious dependency chain. Installing this package executes the obfuscated payload on the victim's machine during npm install.