@or-sdk/tags@1.1.7
Malicious code in @or-sdk/tags (npm)
T1059.007 · JavaScriptT1027 · Obfuscated Files or InformationT1195.002 · Compromise Software Supply Chain
Analysis
The package runs a preinstall hook that downloads the Bun JavaScript runtime and executes a 727KB obfuscated payload (math_init.js) during installation. The payload is encoded with a custom string-obfuscation scheme to hide its behaviour. The package also depends on @or-sdk/base and @or-sdk/data-hub-svc, which are known-malicious packages, indicating the install-time payload is part of a broader supply-chain compromise. Installing this package executes the obfuscated payload on the victim's machine at install time.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 11:56 AM
- analyzed
- Aug 4, 2026, 03:31 PM
- weekly installs
- 884
Related advisories
- @or-sdk/base@0.44.6
- @or-sdk/sdk-api@0.29.4
- @or-sdk/providers@0.3.8
- @or-sdk/transcripts@1.2.7
- @or-sdk/identifiers@0.27.8
- @onereach/v-event-calendar@0.1.24
- @or-sdk/bot-templates@2.2.7
- @or-sdk/qna@3.4.4
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.