@ornikar/browserslist-config@8.0.4

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

npm preinstall

Arbitrary install-time code execution and potential credential theft.

downloads/executes Bun to run obfuscated code with remote eval

On npm preinstall, setup.mjs obtains Bun if absent, then runs math_init.js. That large obfuscated payload includes an evaluated remote response and GitHub token handling, creating an install-time arbitrary-code and credential-risk chain unrelated to a browserslist configuration package.

Direct source inspection confirms an unconsented preinstall bootstrap into an obfuscated payload with remote eval. This is concrete malicious behavior, not a package-aligned dependency setup.