@onereach/or-content-builder-renderer@0.0.4

Analysis

The package runs a preinstall hook that downloads the Bun JavaScript runtime and uses it to execute a 727KB obfuscated payload (math_init.js) at install time. The payload is encoded with a custom base-N decoder and contains eval/Function/child_process calls, making its behaviour opaque to static inspection. The package also depends on a known-malicious package (@onereach/content-builder-template-compiler) and on a typosquatted lodash dependency (loadsh). Installing this package executes the obfuscated payload on the victim's machine during npm install.