@servicetitan/quick-actions @1.15.8

Summary

The package's preinstall hook runs setup.mjs , an obfuscated script (uses _0xNNNN identifier naming and per-function string-lookup maps to hide literals) that detects the installer's platform and architecture, downloads the Bun runtime binary from the oven-sh/bun v1.3.13 GitHub release to a temporary directory with no hash or signature verification, marks it executable, and then invokes it via execFileSync against the sibling file math_init.js . math_init.js is a 727KB single-line, heavily obfuscated blob using string-array rotator + custom-alphabet base-N decoder indirection ( WV8StW rotates the n7gIxM constant table, hc1jfK9 decodes strings from a custom alphabet). The package's advertised purpose is a React quick-actions UI component library, which has no legitimate need to fetch an alternate JavaScript runtime at install time and hand it an opaque obfuscated payload. This is the alternate-runtime-dropper pattern: executing the payload under Bun rather than Node evades Node-focused supply-chain scanners while achieving arbitrary code execution on the installer's host on npm install .

Source: amazon-inspector (4ce669338b91641bf000ea25a5becfc2e4b8a5175a2b97a80551396cfe705196)