@ornikar/eslint-config-node @12.2.10

Summary

This version of the package, advertised as an ESLint configuration, ships a preinstall hook ( scripts.preinstall: "node setup.mjs" ) that downloads the Bun runtime from the oven-sh/bun GitHub release archive (bun-v1.3.13) into a temporary directory, chmods the binary executable, and then invokes it to execute a bundled, heavily obfuscated 727KB JavaScript payload shipped in the tarball as math_init.js . The payload uses string-array rotation ( WV8StW ), a 1000+ entry numeric-index string array ( n7gIxM ), and identifier mangling ( _0xNNNNNN ); it carries a @bun @bun-cjs banner indicating it is bundled specifically to run under the freshly downloaded Bun runtime, bypassing Node-level static and runtime observation. The rest of the package ( index.js ) is the small ESLint config consistent with the advertised name, so the dropper is wholly unrelated to the declared purpose. Behavior fires automatically on npm install . The delta between the advertised purpose (an ESLint config) and the shipped runtime-download + obfuscated-payload behavior is consistent with a compromised release of the @ornikar/* scope rather than an authentic maintainer publish.

Source: amazon-inspector (e8c68ba0d4084dc97826e00fe5b1db53a1e8e2b2e8f683d603d047f4c522dc2c)