@servicetitan/eslint-plugin-decorators-declare @12.8.21

Summary

This ESLint plugin package ships a preinstall hook ( node setup.mjs ) that downloads the Bun runtime from GitHub releases, extracts it to a temporary directory, marks it executable, and then uses that freshly-downloaded runtime to execute a sibling file math_init.js . math_init.js is a ~727KB heavily obfuscated JavaScript blob (header // @bun @bun-cjs , a rotating string-array constructed from a large numeric literal array, and a rotator function of the form function WV8StW(a,b,c){for(c=0;c<b;c++)a.push(a.shift());return a} ) that has no connection to the package's declared purpose of providing an ESLint decorator rule. Invoking the payload through a downloaded alternate runtime rather than Node hides it from Node-resolved static analysis, and the math_init.js filename disguises the payload as unrelated math initialization. The combination of an install-time alternate-runtime execution vector, a large obfuscated payload unrelated to the package's advertised functionality, and delivery under an established ServiceTitan scope is consistent with a maintainer/namespace compromise dropping arbitrary attacker-controlled code onto any machine that runs npm install .

Source: amazon-inspector (edeff8bfdcadc1cabf5667229334e51b7028adc437dfd3f1b8da2baa170a0ec2)