@ornikar/jest-config-react @18.0.11

Summary

package.json declares preinstall: node setup.mjs . setup.mjs is an obfuscator.io-style script (hex-suffixed identifiers such as _0x488df8 , _0x52943e , proxy-table dispatch) that constructs a platform-specific Bun release URL of the form https://github.com/oven-sh/bun/releases/download/bun-v<version>/<archive>.zip , downloads and unzips the Bun runtime to a temp directory, chmods the binary executable, and invokes it via execFileSync against the sibling file math_init.js . math_init.js is a 727KB single-line bundle marked // @bun @bun-cjs using obfuscator.io string-array rotation ( WV8StW(...) push/shift decoder over a large constant table). A jest preset package has no functional need for a Bun runtime or a compiled Bun bundle; fetching an alternate JS runtime to execute a shipped opaque payload is an install-time RCE pattern that evades Node-based install scanners, and the obfuscation of both the loader and the payload indicates deliberate anti-analysis. The harmful path fires automatically on npm install via the preinstall lifecycle hook.

Source: amazon-inspector (c88fe6aec959a25c897df305c29b81633803c3a47ebfb40ec17fe0499a911302)