@or-sdk/identifiers@0.27.8
Malicious code in @or-sdk/identifiers (npm)
T1059.007 · JavaScriptT1027 · Obfuscated Files or InformationT1105 · Ingress Tool TransferT1195.002 · Compromise Software Supply Chain
Analysis
The package's preinstall hook runs an obfuscated setup script (setup.mjs) that downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and executes a bundled 727KB obfuscated payload (math_init.js) containing eval/Function/child_process calls. The package also depends on the known-malicious packages @or-sdk/base and @or-sdk/sdk-api. Installing this package executes an obfuscated second-stage payload at install time; the payload's network endpoints are hidden behind the obfuscation.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 11:58 AM
- analyzed
- Aug 4, 2026, 03:24 PM
Related advisories
- @or-sdk/base@0.44.6
- @or-sdk/sdk-api@0.29.4
- @or-sdk/providers@0.3.8
- @onereach/v-event-calendar@0.1.24
- @or-sdk/bot-templates@2.2.7
- @or-sdk/qna@3.4.4
- @onereach/orest-input-cli@1.18.3
- @onereach/or-browser-next@0.0.13
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.