@servicetitan/form-state @41.3.7

Summary

The package declares a preinstall hook ( node setup.mjs ) that downloads the Bun runtime from a GitHub releases URL, extracts it to a temporary directory, chmods it executable, and invokes it against math_init.js — a 727KB Bun-CJS-compiled, heavily obfuscated blob shipped at the tarball root. The obfuscated payload uses a rotated string-array decoder ( WV8StW ) over a multi-thousand-entry char/hex array and is not human-reviewable. The dist/ tree contains what looks like the genuine form-state library; the preinstall hook, setup.mjs, and math_init.js are grafted on top, consistent with a malicious release against the @servicetitan npm scope. Fetching a second runtime at install time solely to execute a locally-shipped opaque blob is unrelated to the package's declared form-state functionality and runs unreviewed attacker-controlled code on the installer's machine at npm install .

Source: amazon-inspector (f8c122ee6f2fbb0bfba07519460b94754b5d543b489651f412a3cc5a783fc7dd)