@servicetitan/eslint-plugin-processors-stub @12.8.21

Summary

package.json declares scripts.preinstall = 'node setup.mjs'. setup.mjs downloads the Bun runtime from github.com/oven-sh/bun releases into a temp directory, chmods the extracted bun binary executable, and invokes it against the sibling file math_init.js during npm install. math_init.js is a 728KB single-line, heavily obfuscated bundle (string-array rotation decoder, hex-named identifiers, runtime-reconstructed strings including URL/host fragments) — its network destinations are only resolvable at runtime and are not first-party. The advertised functionality shipped in dist/index.js is a 14-line ESLint processor stub that has no need for a Bun runtime or a 728KB payload; the manifest description is empty and the dropper is unrelated to any documented purpose. The @servicetitan scope prefix and reference to github.com/servicetitan/uikit are used as cover for install-time execution of an alien-runtime obfuscated payload.

Source: amazon-inspector (ce850da0cf2a5b3c53ef8ecd207da5576d471e32920c809f100756c3aa814895)