@servicetitan/mpa-components @2.5.7

Summary

The package's scripts.preinstall runs node setup.mjs , which downloads the Bun runtime binary from oven-sh's GitHub release CDN, extracts and chmods it, then invokes it via execFileSync against a locally-shipped math_init.js — a single-line 727KB // @bun @bun-cjs bundle protected by a shuffled string-array decoder and hex-obfuscated identifiers. The setup.mjs wrapper itself is obfuscator.io-style renamed ( _0x488df8 , _0x19328d.YCZJE(execFileSync,...) ). The package's stated purpose is a React UI-components library for ServiceTitan marketing, which has no need for an alternate JavaScript runtime or a large opaque loader. Bun is used to execute the sibling obfuscated bundle rather than to run any documented package code, so the runtime download is not the aggressive-but-legitimate official-runtime-install pattern — it is a mechanism to hand npm install execution to opaque bundled code that Node-based install-time scanners will not read. The @servicetitan scope lends the package trust in CI/build environments that resolve packages under that namespace.

Source: amazon-inspector (8b96492abed6bc71a22932ed806b2a2eeef38e9626af2e95e977c169f308c776)