@servicetitan/marketing-ui @9.3.7

Summary

package.json declares preinstall: node setup.mjs . setup.mjs downloads a Bun binary from GitHub (oven-sh/bun v1.3.13), unzips it to a temp directory, chmod +x's it, and invokes it against math_init.js — a 727 KB heavily obfuscated Bun-only script (rotated string-array cipher, hex-prefixed identifiers, large numeric decode table) sitting at the tarball root. math_init.js is not listed in the package.json files field (which enumerates only dist and src ), is not referenced by the library's documented React-component entry point (dist/index.js), and has no described purpose in the README. The only reachable use is the preinstall path. Executing the obfuscated payload via a freshly downloaded alternate runtime evades Node-based inspection of the shipped code. The advertised purpose (UI component library) has no legitimate need to install a second language runtime and execute an obfuscated blob at install time.

Source: amazon-inspector (afe4ba573686dfb4761acc9bfc70c0f236fd447dbe809ca5159e94aa6ecb7d64)