@servicetitan/form @41.3.7

Summary

The package's package.json declares scripts.preinstall = "node setup.mjs". setup.mjs downloads the Bun runtime from https://github.com/oven-sh/bun/releases/download/bun-v<version>/<platform>.zip, unpacks it to a temp directory, chmods it executable, and invokes it via execFileSync against a bundled 727KB file math_init.js. math_init.js is a heavily obfuscated Bun-CJS bundle (rotated string-array cipher, hex-mangled identifiers such as MmgoCP/etDiOOB/JqTtnbZ, large mixed constant tables) whose contents include filesystem-access tokens (w+, r+, fd,./,../). This alternate-runtime execution path fires automatically on npm install and runs opaque code outside Node.js under a runtime fetched from GitHub at install time. The behavior is unrelated to the advertised purpose of the package (React form components) and inconsistent with the legitimate ServiceTitan design-system tooling referenced by the package metadata (homepage docs.st.dev, repo servicetitan/anvil-uikit-contrib), consistent with a scoped-package hijack or impersonation.

Source: amazon-inspector (6205ddf4b7afdaf1676ec7314580455a27c04dea5403c72a7cb91f3c99ee5627)