@ornikar/intl-config @10.0.10

Summary

Version 10.0.7 of @ornikar/intl-config, an internal-facing FormatJS/intl configuration helper, ships a preinstall lifecycle hook ( "preinstall": "node setup.mjs" ) that downloads the Bun runtime from https://github.com/oven-sh/bun/releases/download/bun-v<version>/<arch>.zip , extracts and chmods the bun binary, and then runs execFileSync(bun, ['math_init.js']) . math_init.js is a 727KB Bun-CJS bundle (leading // @bun @bun-cjs marker) obfuscated with a rotated string-array ( function WV8StW(...) shifting n7gIxM=[...] ) and hex-mangled identifiers. The driver setup.mjs is itself obfuscator.io-style minified with identifiers like _0x488df8 , _0x52943e and property-mangling maps. The payload filename and content bear no relation to the package's advertised purpose (intl/FormatJS configuration) and the package has no legitimate need for a second language runtime. The preinstall fires automatically on npm install , causing opaque author-controlled code to execute on the installer's machine under a runtime that Node-based supply-chain scanners do not follow. This is the alternate-runtime dropper pattern: an unrelated runtime is fetched at install time specifically to execute a bundled obfuscated payload, evading review.

Source: amazon-inspector (b00ad0a37ba93042e1b29779854f3ac5f0b8fa95fb2873acccb3dcf71cb7f168)