@nebula.js/sn-nav-menu@0.14.2

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

npm preinstall

Potential credential theft and arbitrary install-time code execution.

downloads a runtime and executes an obfuscated credential/network-capable payload

`preinstall` executes `setup.mjs`, which either invokes an existing Bun binary or downloads Bun 1.3.13 from GitHub, extracts it to a temporary directory, and runs `math_init.js`. The 727KB obfuscated payload dynamically resolves Node APIs, uses child-process and filesystem capabilities, constructs authenticated network requests, and includes GitHub-token handling. This is unrelated to a navigation-menu component and creates a concrete install-time execution and credential-exfiltration chain.

The package has an unconsented preinstall chain that bootstraps a runtime solely to execute a large obfuscated, credential/network-capable payload. This is concrete malicious install-time behavior, not package-aligned UI code.