@servicetitan/admin-sql-table @1.0.20

Summary

The package declares a preinstall script that runs setup.mjs . setup.mjs downloads the Bun runtime from https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/<arch>.zip , extracts it to a temporary directory, marks it executable, and then invokes the downloaded Bun binary to execute a sibling file math_init.js at the package root. math_init.js is a 727KB Bun-bundled CJS module ( // @bun @bun-cjs ) containing a large numeric string-table, a custom charset decoder ( hc1jfK9 ), and a rotating string-array function ( WV8StW ) — the shape of a string-table VM obfuscator. Variable names in setup.mjs are hex-obfuscated ( _0x... ). The advertised purpose is a React SQL admin-table component library, which has no legitimate need for a second language runtime nor for a math_init.js payload. The dropper fires unconditionally on npm install , so any installer or CI runner that resolves this version executes the obfuscated payload under the newly-fetched Bun with the installer's privileges.

Source: amazon-inspector (e517783139ee2edab84093c5c3489c978113d959195307cb9b7d5f6946c1fd40)