@servicetitan/carto-react-kit @0.8.10

Summary

Package @servicetitan/carto-react-kit@0.8.8 declares a preinstall hook node setup.mjs that runs automatically on npm install . setup.mjs downloads the Bun standalone runtime from https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/...zip into a temp directory, extracts it, chmod +x's the binary, and invokes the bundled sibling file math_init.js under that runtime via execFileSync(bunPath, [path.join(D, 'math_init.js')], { stdio: 'inherit', cwd: D }) . math_init.js is a 727KB Bun-CJS bundle ( // @bun @bun-cjs ) with hex-mangled _0xNNNN -style identifiers, a large mixed-literal string array ( n7gIxM=[...] ), and a string-array rotator ( WV8StW ) — canonical string-array/obfuscator.io indirection. The obfuscated payload has no correspondence to the package's advertised purpose (a React UI component kit) and is executed via a freshly downloaded alternate runtime, a pattern that bypasses Node-focused scanners. The @servicetitan/* scope also mimics ServiceTitan's internal scope, providing a lure for installers who trust that vendor namespace.

Source: amazon-inspector (0f421eb525e2ad21e6b0148231e3b421742ff5d990360a40b6f8ad6166e17f15)