@arv-bedrock/auth-admin@1.0.2

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

npm preinstall

Credential theft and arbitrary code execution during installation.

downloads Bun, executes obfuscated credential harvester, and evals remote code

On npm install, package.json launches setup.mjs. It downloads and executes Bun to run math_init.js. That obfuscated payload executes immediately, collects token-bearing credential sources and environment data, and contains a remote fetch-to-eval path, enabling theft and attacker-controlled code execution.

The install-time chain is unrelated to the advertised authentication SDK and contains concrete credential-harvesting plus remote-code execution behavior.