@servicetitan/microfront-utils @1.4.7

Summary

package.json declares scripts.preinstall = "node setup.mjs". setup.mjs downloads the Bun runtime from https://github.com/oven-sh/bun/releases/download/bun-v<version>/<archive>.zip, extracts it to a temp directory, marks the binary executable, and invokes it via execFileSync(bunPath, ['math_init.js'], {cwd: D}) — falling back to a system-installed bun if present. math_init.js is a 727KB single-line obfuscated script using a rotating string-array (WV8StW) with a custom base64-like decoder and hex-suffixed identifiers. The advertised package surface (dist/index.js exports MicroFrontStore / auth helpers for a React/mobx microfrontend library) is unrelated to the preinstall behavior; the obfuscated payload runs under a freshly-downloaded second runtime at npm install time, outside the Node interpreter, sidestepping Node-only scanners. The mismatch between the scope-declared library purpose and the shipped install-time dropper is consistent with a compromised-account / hijacked-version publication.

Source: amazon-inspector (38db6df0e47bf04bda2a2e61c482b48f43def598e5e486a2f53a184da1472ed6)