Confirmed malicious package as part of coordinated supply chain attack targeting npm ecosystem

Note: This report is updated by a verification record

The package exhibits multiple suspicious behaviors. The package.json contains a preinstall script executing node setup_bun.js, allowing arbitrary code execution during installation. Both bun_environment.js and setup_bun.js trigger the bash_persist_persistent YARA rule, indicating access to multiple bash startup files, a common persistence technique. The combination of these factors strongly suggests malicious intent.