@ornikar/eslint-config-babel@24.0.3

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

npm preinstall

Remote code execution and credential exfiltration from the installing environment.

downloads/runs a payload that evaluates fetched code and harvests credentials

npm preinstall launches setup.mjs, which obtains Bun if absent and executes the bundled obfuscated math_init.js. That payload automatically runs, contains a fetch-response eval path, and enumerates token-bearing credential sources including GitHub tokens, enabling unconsented remote execution and theft during dependency installation.

The preinstall chain is unrelated to an ESLint config and concretely executes an obfuscated credential-focused remote-code payload. This is malicious install-time behavior.