@onereach/rwc-client@6.4.9
Malicious code in @onereach/rwc-client (npm)
T1059.007 · JavaScriptT1195.002 · Compromise Software Supply ChainT1105 · Ingress Tool Transfer
Analysis
The package's preinstall hook (setup.mjs) downloads the Bun runtime and then executes a heavily-obfuscated 727KB payload (math_init.js) at install time. The payload is obfuscated with a javascript-obfuscator string-array decoder and thousands of _0x identifiers, hiding its runtime behaviour. The package also depends on the known-malicious packages @or-sdk/flows, @or-sdk/step-templates, and @or-sdk/store, which are pulled in during installation. Installing this package runs the obfuscated payload on the victim's machine via the downloaded runtime.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 01:19 PM
- analyzed
- Aug 4, 2026, 03:24 PM
Related advisories
- @onereach/ui-components@27.0.4
- @onereach/ui-components-vue2@27.0.4
- @onereach/expression-components@9.1.3
- @or-sdk/transcripts@1.2.7
- @or-sdk/identifiers@0.27.8
- @servicetitan/cp-mfe-dev@1.115.4
- @or-sdk/api-tokens-lambda@1.4.4
- @servicetitan/grid@0.0.66
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.