@ornikar/react-native-svg-transformer @1.0.13

Summary

The package declares preinstall: node setup.mjs . setup.mjs performs OS/arch/libc detection (linux/darwin/win, x64/arm64, musl/Alpine), downloads the Bun runtime archive from https://github.com/oven-sh/bun/releases/download/bun-v<version>/...zip , extracts it, chmods +x, and then invokes execFileSync(bunPath, [path.join(D, 'math_init.js')], { stdio: 'inherit', cwd: D }) . The executed sibling math_init.js is a ~727KB Bun-compiled bundle ( // @bun @bun-cjs ) obfuscated with string-array rotation ( WV8StW rotator against a large n7gIxM constants table) and randomized identifiers; its behavior is only reachable after multi-layer deobfuscation and does not correspond to SVG transformation. package.json declares "files": ["index.js", "CHANGELOG.md", "README.md"] , yet the tarball also ships setup.mjs and math_init.js — the two files that actually execute at install are absent from the declared file allowlist. index.js mirrors the upstream unscoped react-native-svg-transformer implementation to preserve advertised behavior, while the malicious chain is grafted on via preinstall under an org-scoped name that resembles the legitimate package. Installing this package on a default npm install fetches and runs an alternate runtime to execute an unrelated, obfuscated payload with no relation to the package's stated SVG-transformer purpose.

Source: amazon-inspector (975ebafd6228d6eacc7ab142d5c1a70e4639c44cfd248107083a6ec641788025)