@deliveroo/reevent@1.0.1

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

npm preinstall

Arbitrary code execution and potential theft or abuse of npm/GitHub credentials.

remote payload execution with credential harvesting capability

The preinstall hook runs setup.mjs, which runs the obfuscated math_init.js directly or first downloads a Bun executable from GitHub and runs it. The payload contains child-process execution, credential-token logic, and an eval of network-fetched response text, enabling remotely supplied code to run during installation.

The concrete preinstall chain into an obfuscated credential-aware payload that evaluates remote content is malicious behavior, not a package-aligned bootstrap.