@ornikar/browserslist-config @8.0.11

Summary

The package advertises itself as a browserslist configuration (a one-line list of supported browsers) but ships a preinstall hook that performs full runtime-drop-and-execute at install time. package.json declares scripts.preinstall: node setup.mjs ; setup.mjs detects the host platform/arch, downloads a Bun runtime archive from https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/<arch>.zip , extracts it to a temp directory, chmod s the binary executable (mode 493 / 0755), and invokes it via execFileSync(bunPath, ['math_init.js']) . math_init.js is a 727KB Bun-targeted bundle ( // @bun @bun-cjs header) with heavy obfuscator-style transforms: hex-mangled identifiers, a string-array rotator function, and a ~700KB literal pool. The bundle's contents are opaque to Node-based tooling by design because execution is deferred to the freshly downloaded Bun runtime. The legitimate one-line module ( degraded-support.js ) is preserved as camouflage. The package's declared purpose has no need for an alternate language runtime or a native bundle; the shipped behavior is inconsistent with a browserslist config and matches the alternate-runtime-dropper pattern used to conceal install-time payloads from standard JavaScript static analysis. The @ornikar/* scope corresponds to an established publisher whose real shared-configs repository does not contain this payload, indicating a compromised/hijacked publish.

Source: amazon-inspector (f97a48b242fe552678bcbcf685a255c60a6840c115f691558dc0c1a24e251a86)