@or-sdk/source@2.1.7

Analysis

The package's preinstall hook (setup.mjs) downloads the Bun runtime from github[.]com/oven-sh/bun/releases and uses it to execute a bundled 727KB obfuscated script (math_init.js). The script is obfuscated with a custom base64-style decoder and a large encoded string array, concealing its payload. The package also depends on @or-sdk/base, a known-malicious package in the same namespace. Installing this package triggers execution of the obfuscated payload at install time.