server-hemera-mongo@0.0.16

Summary

server-hemera-mongo@0.0.12 declares an npm preinstall hook that runs setup.mjs. setup.mjs is obfuscated (hex-encoded identifiers, per-call string-lookup wrapper objects hiding execFileSync/https.get/writeFileSync) and downloads the Bun runtime from github.com/oven-sh/bun releases, unzips it into the package directory, and then invokes the downloaded Bun binary to execute a sibling file math_init.js. math_init.js is a ~728KB Bun-compiled bundle carrying a // @bun @bun-cjs header and a shuffled string-array indirection scheme (WV8StW rotator, numeric-index lookup), and is not human-readable. The package's advertised purpose is a small hemera/mongo/nats demo, which does not require an alternate language runtime. Fetching a second runtime at install time and using it to execute an obfuscated bundled payload places the actual attacker-controlled logic outside what Node-based tooling and reviewers can inspect, and hands arbitrary code execution to whatever math_init.js contains on any machine that runs npm install on this package.

Source: amazon-inspector (37cb6205f8355196f20c1f3d2b39c31e19250efd54826ed2a0e54c7b02970dff)