@onereach/expression-components@9.1.3
Malicious code in @onereach/expression-components (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool Transfer
Analysis
The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases and executes a bundled 727KB script (math_init.js) with it during installation. math_init.js is heavily obfuscated with a custom string-table encoding, making its runtime behavior opaque; it is executed automatically on install with no opt-in. No plaintext C2/exfil endpoint was observed in the readable portion of the package.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 01:16 PM
- analyzed
- Aug 4, 2026, 03:34 PM
Related advisories
- @onereach/ui-components@27.0.4
- @onereach/ui-components-vue2@27.0.4
- @onereach/rwc-client@6.4.9
- @servicetitan/anvil-token@0.4.4
- @or-sdk/transcripts@1.2.7
- @or-sdk/identifiers@0.27.8
- @servicetitan/cp-mfe-dev@1.115.4
- @or-sdk/api-tokens-lambda@1.4.4
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.