Note: This report is updated by a verification record
Multiple YARA rule matches and suspicious preinstall script execution strongly suggest malicious intent, classifying the package as malware.
The package is marked as malware by OSV: MAL-2025-191155 with source: ghsa-malware
Note: This report is updated by a verification record
The package exhibits multiple suspicious behaviors that, when combined, strongly suggest malicious intent. Specifically, the package.json file contains a preinstall script that executes setup_bun.js. Both bun_environment.js and setup_bun.js trigger the bash_persist_persistent YARA rule, indicating attempts to modify shell startup files for persistence. The npm_preinstall_command YARA rule is also triggered. The preinstall script execution is further flagged as suspicious by the LLM based file evaluation service. These multiple indicators provide a strong case for classifying this package as malware.
