@or-sdk/mcp-tools@0.5.4

Analysis

The package runs a preinstall hook (node setup.mjs) that downloads the Bun runtime from github[.]com/oven-sh/bun and uses it to execute a 727KB obfuscated script bundled as math_init.js. The script is obfuscated with a large encoded string array and a custom decoder, and contains eval/Function-constructor and child_process usage. The package also depends on @or-sdk/base, a known-malicious package. Installing this package executes the obfuscated payload on every install.