@servicetitan/confirm-navigation @41.3.7
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 1:58 AM UTC
OSV ID
MAL-2026-11840
Ecosystem
npm
Summary
package.json declares scripts.preinstall = 'node setup.mjs'. setup.mjs downloads the Bun runtime from github.com/oven-sh/bun/releases, extracts it to a temp directory, chmods it executable, and invokes it against math_init.js — a 727KB heavily obfuscated sibling file at the tarball root using obfuscator.io-style rotated string-array decoding (decoder function hc1jfK9). math_init.js is not listed in package.json files (which declares only dist and src) and its name has no relation to the package's advertised purpose (a React navigation-confirmation component). The alternate-runtime dropper pattern — fetching a second language runtime to execute an opaque, undeclared payload — bypasses scanners tied to Node semantics and produces arbitrary code execution as the installing user on every npm install.
Source: amazon-inspector (faf338296f2261529068d7f3ba76205985b69564d8add20b8d97a8f803a5df05)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.