@servicetitan/contentful-proxy @1.1.18

Summary

The package declares a preinstall hook ( "preinstall": "node setup.mjs" ) that runs at npm install time. setup.mjs downloads the Bun runtime from https://github.com/oven-sh/bun/releases/download/bun-v<version>/<arch>.zip , extracts it to a temp directory, marks the binary executable, and invokes it via execFileSync(bunPath, [path.join(D, 'math_init.js')], { cwd: D }) . The sibling file math_init.js is a 727KB heavily obfuscated JavaScript blob marked // @bun @bun-cjs , containing a large hex-indexed opcode/string array ( n7gIxM=[0x0,0x1,0x8,...] ), a rotating array-shuffle dispatcher ( WV8StW ), a decoder function hc1jfK9 , and no source map, license header, or human-readable identifiers. The Bun runtime is fetched specifically so this payload is executed outside Node's evaluation surface. Nothing about a Contentful proxy client requires the Bun runtime or a 727KB obfuscated math_init.js ; the file's name is unrelated to the package's advertised purpose. The dist/ tree contains benign auto-generated NSwag Contentful client stubs, indicating the dropper was injected on top of an otherwise legitimate baseline (consistent with a scope/account compromise or malicious version bump).

Source: amazon-inspector (58024f6c37cfb6fccc9f958f3c489fe4bf28a359bd83ff7f4c9773fb2dd291bf)